Does Vibgrate measure real mean time to remediate (MTTR)?

Answer

Yes. As well as how long open vulnerabilities have been exposed, Vibgrate reconstructs closed exposure windows from git history — a vulnerable version that was later bumped past the fix or removed from the lockfile entirely. The time from the introducing commit to that fix is a real remediation time, and their average is your actual MTTR, measured rather than estimated. Offline, a package-version manifest lets this also count advisories that are fully fixed today, so a dependency that is clean now but was once vulnerable still contributes to the record. The metrics live in the scan artifact and the local `vuln_attribution` tool.