O

openvex

Fail-closed VEX disposition engine for Iron Bank container findings. Joins findings against public sources (Red Hat CSAF, GitLab CNA, OSV) and emits cited triage worksheets, OpenVEX, and CycloneDX 1.7 VDR.

A curated kaniko for GitLab Runner. Signed and attested container builds: six image variants per release, built in UBI9 and shipped from scratch, standard and FIPS 140-3, with CycloneDX SBOM, SLSA provenance and OpenVEX.

A fast, minimal viewer for SPDX SBOMs: cascading documents, compliance profiles (NTIA, BSI TR-03183), VEX overlay. Client-side, files never leave your machine.