Some security issues only affect certain platform (as in operating systems, Linux distributions, etc.) The data model should include this information and allow querying for it to avoid false positives. The natural way to include this on the query side is with a platform qualifier on the package URL.
Here is an example of a vulnerability in a Rust crate that only affects Windows: https://github.com/RustSec/advisory-db/blob/master/crates/hyper/RUSTSEC-2016-0002.toml
Some security issues only affect certain platform (as in operating systems, Linux distributions, etc.) The data model should include this information and allow querying for it to avoid false positives. The natural way to include this on the query side is with a platform qualifier on the package URL.
Here is an example of a vulnerability in a Rust crate that only affects Windows: https://github.com/RustSec/advisory-db/blob/master/crates/hyper/RUSTSEC-2016-0002.toml