Report data
The JSON files are the recorded data from the supply-chain-data branch and are covered by the attestation described on the verification page. CSV files are derived from that JSON when the site is built and are not attested themselves.
| File | Contents |
|---|---|
index.json | List of weekly runs, newest first, and superseded runs. |
runs/2026-11-02.json | This week's summary: one row per project, tool versions, and provenance. |
projects/<owner>__<repo>.json | Per project: latest inventory, every advisory match, checks, and weekly history. |
SHA256SUMS | SHA-256 of every data file; attested by the workflow. |
projects.csv | Derived: this week's project table. |
matches.csv | Derived: one row per project and advisory match, with KEV and EPSS. |
advisories.csv | Derived: one row per distinct advisory, with the tools it matches. |
Atom feeds: weekly summary, and projects/<owner>/<repo>/feed.xml for each project.