Follow one product from release to evidence packet

Step 1 of 6

Add the product and its release

The owner creates the product record with a boundary statement, then adds release 1.4.0 with its support period.

Step 2 of 6

Import the SBOM

A CycloneDX JSON SBOM gives the release its component list. The import run is kept with the hash of the uploaded file. One component has no package URL and a vendor-specific version, which matters in the next step.

Step 3 of 6

Import advisories and review the matches

Two fictional OSV advisories are imported. One match is confirmed by exact package identity and version range; the other stays uncertain and says why.

Step 4 of 6

Triage: separate facts, one decision

Severity, exposure and exploitation are recorded separately. The confirmed finding sits on the public listener, so it gets critical priority; the uncertain one waits for a person to verify its identity.

Step 5 of 6

Fix, retest and independent review

The owner upgrades the parser, attaches retest evidence and submits the fix. A different person, the reviewer, validates it; only then is the finding closed.

Step 6 of 6

Export the evidence packet

The packet freezes the product state, provenance and journal, and lists what is still unresolved instead of hiding it.

The manifest hash identifies this exact packet. It proves the bytes have not changed since export, not that the content is true.