VGNA-run reports
ClamAV, MobSF, Syft, and Grype
Loading evidence…
Trust boundary: VGNA's hashes and signature prove which files and reports VGNA published and whether they changed. They do not prove that a self-run scanner's diagnosis is independently true. Use the official tool links and raw manifest-bound results to audit or reproduce the work.