Read-only checker on the Phase-0 substrate: scans $MIRROR_DIR mirrors for pinned deps (requirements/poetry/Pipfile/package-lock/yarn/csproj across PyPI/npm/NuGet), cross-refs OSV querybatch (live) or an offline advisory fixture (canary). Mode-600 reports, ALARM-only, --canary asserts 2 planted vulns (jinja2 2.11.2, lodash 4.17.15). Complements Dependabot. Not provisioned. |
||
|---|---|---|
| .. | ||
| hooks | ||
| info | ||
| logs | ||
| objects | ||
| refs/heads | ||
| COMMIT_EDITMSG | ||
| config | ||
| description | ||
| HEAD | ||
| index | ||