Fitting in
Reports and exports
JSON, CSV, SARIF, SBOMs, VEX, and an audit trail of every decision.
Written on every scan
And rewritten whenever a decision changes what is reportable, so the files never disagree with the screen. Each is written atomically, so a reader never sees half a file.
The files a scan leaves behind
The SBOMs and the VEX documents are downloadable from the same page: both combined bills of material, the component and license rollup, the per repository set as one zip, and both VEX dialects. The SBOMs are the only files there the rebuild button does not touch and cannot, because the database keeps the packages a finding was raised against rather than every component of every repository. The page says so rather than leaving somebody to press the button and wonder.
A schema that is published
The JSON report validates against a JSON Schema that ships with the product, and the scanner can validate a report against it on demand.
The audit log
Every decision, searchable as you type, with each event opening to show the whole detail and a link to whatever it names. Settings changes name which setting moved, never the value.
What it does not do
Nothing here is scheduled: a report is written when a scan runs or when somebody asks for one, and there is no way to have one mailed out every Monday.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.