[0xsan7]

Summary

Source-based bug investigation in a fresh temporary GitHub clone. Reproductions preceded fixes, with repeated adjacent-path review and regression passes.

• Fix ignored CLI policy options, JSON decision propagation, baseline paths and validation, incomplete-scan baseline writes, and partial inventory handling.
• Fix nested monorepo discovery, ignore-path enforcement, scoped drift/newness, multiple-version preservation, and reverse-dependent traversal.
• Correct CVSS scope arithmetic and malformed-value handling; preserve score/vector pairing and package-specific fixes through hydration and caching.
• Surface OSV batch alignment/pagination gaps and partial EPSS failures; validate advisory identity/probabilities and honor cache TTL/offline settings.
• Correct maintenance risk direction, SBOM producer version/checksum semantics, and CycloneDX affected-component references.
• Add 42 Go regressions, a CVSS fuzz target, and harness checks; expand the mutation audit from 40 to 69 cases.

Validation

• Full go test -race ./... -count=1 passed on macOS arm64 / Go 1.23.4.
• Configured golangci-lint v1.64.5, vet, formatting, corpus check, and generated-doc checks passed.
• 23 fuzz targets passed for 10 seconds each; four serializer targets repeated after the checksum fixes.
• 69/69 selected mutations killed; zero survivors, invalid mutants, or broken anchors.
• Both generated SBOMs passed official JSON schemas; GoReleaser v2.5.1 configuration check passed.
• Full-history gitleaks passed before pushing.

See docs/audits/2026-10-12.md for reproductions, compatibility notes, and remaining limitations.

Review notes

Maintenance-enabled scores and some CVSS scope-changed scores change. Unknown policy fields, unsupported sources, and incomplete inventories now fail explicitly. SBOMs omit fabricated package checksums. Advisory cache entries are refreshed under a new namespace to retain affected-package data.

This is a post-v0.2.0 review branch. Main, the published binaries, and all release tags remain unchanged. No new release is requested by this PR. Passing checks do not establish that a last bug has been found.

Final GitHub verification

Latest head: b640e117a60255732a6e723762d9c0b8a509c415.
14 checks passed, 2 skipped, 0 failed.

• Platform CI: all six OS/Go matrix legs passed; statement coverage 71.3%.
• Fuzz and mutation: all 23 fuzz targets passed at 39 seconds each; 69/69 mutations killed, zero survivors/invalid/broken cases.
• Secret scans: pinned full-history Gitleaks and trufflehog passed.

The first PR exposed an additional CI-only defect: unsupported Gitleaks Action inputs and a missing PR token. Follow-up commit replaces the wrapper with the pinned CLI and verifies a synthetic credential positive control locally. No additional token permission was introduced.