Scan dependencies. Triage findings. Export CycloneDX VEX.

Paste a CycloneDX/SPDX SBOM, npm package.json, or pip requirements.txt. We match against OSV.dev and produce a triage table you can export as a VEX 1.5 document.