Dumpscan

Vulnerability scanner whose every result is a reproducible, signed claim. Pins the lockfile, the OSV feed, the version comparators, and the exclusions to four digests inside a signed in-toto predicate, so anyone can replay a scan byte for byte, or get a diff naming exactly which input moved.

Description excerpted from the original listing, which is linked below.