11/12 Findings ≥ medium in live software are never dumped raw. They publish as "withheld-pending-disclosure": attestation public immediately, finding body a body_sha256 commitment until a fix ships....
12/12 Early days: schema, CLI, CI, live site, three signed attestations. We need co-maintainers, auditors with a Nostr/SSH/PGP key willing to review AI findings, and target nominations.
Registry: https://theicaruswings.github.io/opensourcecheck/
Code: https://github.com/TheIcarusWings/opensourcecheck
Registry: https://theicaruswings.github.io/opensourcecheck/
Code: https://github.com/TheIcarusWings/opensourcecheck