SecuLens 1.x is supported. Do not treat its findings as a complete security assessment.

Please report exploitable defects privately through GitHub's private vulnerability reporting feature for this repository when available. Do not post customer SBOMs, proprietary source or credentials in public issues. If private reporting is unavailable, open a minimal issue asking for a private reporting channel without publishing exploit details.

The CLI only contacts OSV when --fetch-osv is explicitly selected. Offline snapshots and policies are local inputs. Word and JSON outputs can contain package names, advisory details and source excerpts; handle reports according to the customer's data policy.