drop vendor audit logs + sbom + build pipeline exports · third-party breach scope binder · runs locally
drop vendor audit logs + sbom + build pipeline exports · local only
heuristic screener · vendor schema varies · not definitive proof