Making it usable
Software inventory
A finding exists because somebody published an advisory. A package exists because it is in the tree. When a release is announced as compromised on a Tuesday morning there is no advisory until Thursday, and the only question worth asking on Tuesday is whether that exact version is anywhere in the code.
Built from the SBOM, not from the findings
Blast radius has two parts: Access, which is who can reach a repository, and Software, which is what is in one. The Software half is read straight out of the bill of materials a scan writes, so a package with nothing against it still gets a row. Advisories are joined on afterwards, which is the right way round: it never asked whether the package was interesting before recording it.
The branch is part of the answer
A release branch routinely pins a version the default branch has already moved past, so each branch is a place of its own here. "We upgraded that" is only ever true of a branch somebody checked, and this is the page that tells you which.
Search it the way it will be quoted at you
By name, or by package URL. Type a name and get every repository and branch holding it, with the version, the license and whatever advisories exist against that exact version. A package that is itself the attack is marked as that rather than as a severity.
Export exactly what you searched for
CSV and JSON come out flat, one row per package per branch per repository, so the file joins to whatever list of owners a team already keeps. The same search also comes out as a CycloneDX document, with a real dependency graph in it, for the tools that will only read one.
A rescan replaces rather than adds
A package that has been removed disappears instead of sitting there looking stale and sending somebody to upgrade something that went months ago. Repositories a scan did not cover keep what they had, and a scan stopped part way keeps the inventory for the repositories that finished.
What it does not do
It only knows what a scan collected, so a repository last scanned with SBOMs switched off is not in it, and the page says how much has been collected rather than implying it is everything. Branches other than the default appear only where the scan was told to walk them. It does not record which package pulled in which, so it will not draw you a tree.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.