# Reporting Advisories (and Issues)
`crev` (and so `cargo-crev`) comes with support for issue/advisory reporting.
Both issues and advisories are an optional section of a *package review proof*.
For this reason they are always associated with a specific crate version, which
makes them work in a bit peculiar way
## Issues
`cargo crev report` can be used to report an issue in a given release of a crate.
Each issue is marked with an ID. It can be any string. Identifiers like `CVE-xxxx-xxxx`,
`RUSTSEC-xxxx-xxxx` are recommended, but when not available an URL can be used instead.
Issues associated with a crate version, are only stating that this particular release is affected.
The do not imply that this is neccesarily the first or only version being affected.
Also, issues are treated as an open from the first version reported.
`crev` will consider all the later versions to be affected as well, until a corresponding
*advisory* is found with a matching `id`.
**It is generaly better to report *advisories* instead of issues**. Issues are
most useful when the fixed release is not yet available, so it's impossible to create
an advisory associated with a version that does not yet exist.
## Advisories
`cargo crev advise` can be used to create *package review proof* including an advisory.
Advisory should be reported on the first version fixing a problem for a given range of
previously affected versions.
For simplicity a single `range` field is used to specify the range of affected versions.
For example: If a problem affects all releases from 1.4.0 and the fix was released in
the version 1.4.5, a `range: minor` since the whole minor release was affected (all versions
matching 1.4.x, before release containing the advisory).
This simplifies specifing the range, but is not always precise. Had the issue been
first introduced in version 1.4.1, the version 1.4.0 would be incorrectly affected as well.
This is however rare and overshooting is not a problem.
In some cases the same advisory might need to be created for multiple versions. I.e. when
the patched versions was provided for multiple affected major versions.