A tool and framework to manage a vulnerability's assessment lifecycle through VEX.

Easy digital signing library with support for sigstore and key pairs.

🔴🟡🟢 The Amazing Multipurpose Policy Engine (and L)

Sign and package attestations in sigstore bundles

Attestation collector and parsers

A more secure way to store credentials for CLI programs.

The carabiner Lamplight service client

A CLI utility to interact with Carabiner's Deadrop token exchanger

Normalize and attest test results

Client and library for attestation storage