{
  "version": "repository-evidence@2",
  "sample_sha256": "ea12c7013f554d88b166d14c4646acd7e79fe425aad56dd0e56d6208888b5542",
  "repositories_sha256": "dd54c33b9c1dbda8ff13fd251d1102ea543f06ab24485413f8318ba2f39e584a",
  "observations_sha256": "d3e63586f8f93887136b7f9c726b98b5d63cf5ab61eefea8ce8c105c33663c46",
  "started_at": "2026-09-07T21:59:41.400Z",
  "completed_at": "2026-09-07T22:07:08.522Z",
  "sample_size": 300,
  "overall": [
    {
      "metric": "manifest",
      "label": "Dependency manifest detected",
      "observed": 299,
      "not_detected": 1,
      "unknown": 0
    },
    {
      "metric": "lockfile",
      "label": "Lockfile detected",
      "observed": 171,
      "not_detected": 127,
      "unknown": 2
    },
    {
      "metric": "sbom",
      "label": "Repository SBOM document detected",
      "observed": 0,
      "not_detected": 293,
      "unknown": 7
    },
    {
      "metric": "cyclonedx",
      "label": "CycloneDX JSON detected",
      "observed": 0,
      "not_detected": 293,
      "unknown": 7
    },
    {
      "metric": "spdx",
      "label": "SPDX JSON detected",
      "observed": 0,
      "not_detected": 293,
      "unknown": 7
    },
    {
      "metric": "security_md",
      "label": "SECURITY.md detected",
      "observed": 146,
      "not_detected": 154,
      "unknown": 0
    },
    {
      "metric": "reporting_contact",
      "label": "Reporting-contact text signal",
      "observed": 77,
      "not_detected": 161,
      "unknown": 62
    },
    {
      "metric": "disclosure_process",
      "label": "Disclosure-process text signal",
      "observed": 49,
      "not_detected": 181,
      "unknown": 70
    },
    {
      "metric": "security_updates",
      "label": "Security-update text signal",
      "observed": 30,
      "not_detected": 183,
      "unknown": 87
    },
    {
      "metric": "support_eol",
      "label": "Support / EOL text signal",
      "observed": 92,
      "not_detected": 156,
      "unknown": 52
    },
    {
      "metric": "release_process",
      "label": "Release-process text signal",
      "observed": 67,
      "not_detected": 173,
      "unknown": 60
    },
    {
      "metric": "ci_build",
      "label": "CI / build configuration detected",
      "observed": 286,
      "not_detected": 14,
      "unknown": 0
    },
    {
      "metric": "architecture",
      "label": "Architecture / design document detected",
      "observed": 55,
      "not_detected": 241,
      "unknown": 4
    },
    {
      "metric": "security_testing",
      "label": "Security-testing tool or text signal",
      "observed": 101,
      "not_detected": 153,
      "unknown": 46
    },
    {
      "metric": "release_lineage",
      "label": "Published release reference observable",
      "observed": 300,
      "not_detected": 0,
      "unknown": 0
    }
  ],
  "ecosystems": [
    {
      "ecosystem": ".NET",
      "sample_size": 50,
      "metrics": [
        {
          "metric": "manifest",
          "label": "Dependency manifest detected",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        },
        {
          "metric": "lockfile",
          "label": "Lockfile detected",
          "observed": 13,
          "not_detected": 37,
          "unknown": 0
        },
        {
          "metric": "sbom",
          "label": "Repository SBOM document detected",
          "observed": 0,
          "not_detected": 49,
          "unknown": 1
        },
        {
          "metric": "cyclonedx",
          "label": "CycloneDX JSON detected",
          "observed": 0,
          "not_detected": 49,
          "unknown": 1
        },
        {
          "metric": "spdx",
          "label": "SPDX JSON detected",
          "observed": 0,
          "not_detected": 49,
          "unknown": 1
        },
        {
          "metric": "security_md",
          "label": "SECURITY.md detected",
          "observed": 13,
          "not_detected": 37,
          "unknown": 0
        },
        {
          "metric": "reporting_contact",
          "label": "Reporting-contact text signal",
          "observed": 8,
          "not_detected": 40,
          "unknown": 2
        },
        {
          "metric": "disclosure_process",
          "label": "Disclosure-process text signal",
          "observed": 5,
          "not_detected": 42,
          "unknown": 3
        },
        {
          "metric": "security_updates",
          "label": "Security-update text signal",
          "observed": 2,
          "not_detected": 42,
          "unknown": 6
        },
        {
          "metric": "support_eol",
          "label": "Support / EOL text signal",
          "observed": 14,
          "not_detected": 36,
          "unknown": 0
        },
        {
          "metric": "release_process",
          "label": "Release-process text signal",
          "observed": 5,
          "not_detected": 41,
          "unknown": 4
        },
        {
          "metric": "ci_build",
          "label": "CI / build configuration detected",
          "observed": 42,
          "not_detected": 8,
          "unknown": 0
        },
        {
          "metric": "architecture",
          "label": "Architecture / design document detected",
          "observed": 2,
          "not_detected": 47,
          "unknown": 1
        },
        {
          "metric": "security_testing",
          "label": "Security-testing tool or text signal",
          "observed": 13,
          "not_detected": 34,
          "unknown": 3
        },
        {
          "metric": "release_lineage",
          "label": "Published release reference observable",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        }
      ]
    },
    {
      "ecosystem": "JavaScript/TypeScript",
      "sample_size": 50,
      "metrics": [
        {
          "metric": "manifest",
          "label": "Dependency manifest detected",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        },
        {
          "metric": "lockfile",
          "label": "Lockfile detected",
          "observed": 48,
          "not_detected": 2,
          "unknown": 0
        },
        {
          "metric": "sbom",
          "label": "Repository SBOM document detected",
          "observed": 0,
          "not_detected": 50,
          "unknown": 0
        },
        {
          "metric": "cyclonedx",
          "label": "CycloneDX JSON detected",
          "observed": 0,
          "not_detected": 50,
          "unknown": 0
        },
        {
          "metric": "spdx",
          "label": "SPDX JSON detected",
          "observed": 0,
          "not_detected": 50,
          "unknown": 0
        },
        {
          "metric": "security_md",
          "label": "SECURITY.md detected",
          "observed": 31,
          "not_detected": 19,
          "unknown": 0
        },
        {
          "metric": "reporting_contact",
          "label": "Reporting-contact text signal",
          "observed": 16,
          "not_detected": 21,
          "unknown": 13
        },
        {
          "metric": "disclosure_process",
          "label": "Disclosure-process text signal",
          "observed": 6,
          "not_detected": 25,
          "unknown": 19
        },
        {
          "metric": "security_updates",
          "label": "Security-update text signal",
          "observed": 6,
          "not_detected": 26,
          "unknown": 18
        },
        {
          "metric": "support_eol",
          "label": "Support / EOL text signal",
          "observed": 16,
          "not_detected": 24,
          "unknown": 10
        },
        {
          "metric": "release_process",
          "label": "Release-process text signal",
          "observed": 12,
          "not_detected": 23,
          "unknown": 15
        },
        {
          "metric": "ci_build",
          "label": "CI / build configuration detected",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        },
        {
          "metric": "architecture",
          "label": "Architecture / design document detected",
          "observed": 14,
          "not_detected": 36,
          "unknown": 0
        },
        {
          "metric": "security_testing",
          "label": "Security-testing tool or text signal",
          "observed": 15,
          "not_detected": 20,
          "unknown": 15
        },
        {
          "metric": "release_lineage",
          "label": "Published release reference observable",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        }
      ]
    },
    {
      "ecosystem": "Python",
      "sample_size": 50,
      "metrics": [
        {
          "metric": "manifest",
          "label": "Dependency manifest detected",
          "observed": 49,
          "not_detected": 1,
          "unknown": 0
        },
        {
          "metric": "lockfile",
          "label": "Lockfile detected",
          "observed": 25,
          "not_detected": 25,
          "unknown": 0
        },
        {
          "metric": "sbom",
          "label": "Repository SBOM document detected",
          "observed": 0,
          "not_detected": 48,
          "unknown": 2
        },
        {
          "metric": "cyclonedx",
          "label": "CycloneDX JSON detected",
          "observed": 0,
          "not_detected": 48,
          "unknown": 2
        },
        {
          "metric": "spdx",
          "label": "SPDX JSON detected",
          "observed": 0,
          "not_detected": 48,
          "unknown": 2
        },
        {
          "metric": "security_md",
          "label": "SECURITY.md detected",
          "observed": 32,
          "not_detected": 18,
          "unknown": 0
        },
        {
          "metric": "reporting_contact",
          "label": "Reporting-contact text signal",
          "observed": 16,
          "not_detected": 22,
          "unknown": 12
        },
        {
          "metric": "disclosure_process",
          "label": "Disclosure-process text signal",
          "observed": 13,
          "not_detected": 26,
          "unknown": 11
        },
        {
          "metric": "security_updates",
          "label": "Security-update text signal",
          "observed": 7,
          "not_detected": 27,
          "unknown": 16
        },
        {
          "metric": "support_eol",
          "label": "Support / EOL text signal",
          "observed": 17,
          "not_detected": 21,
          "unknown": 12
        },
        {
          "metric": "release_process",
          "label": "Release-process text signal",
          "observed": 12,
          "not_detected": 28,
          "unknown": 10
        },
        {
          "metric": "ci_build",
          "label": "CI / build configuration detected",
          "observed": 48,
          "not_detected": 2,
          "unknown": 0
        },
        {
          "metric": "architecture",
          "label": "Architecture / design document detected",
          "observed": 14,
          "not_detected": 36,
          "unknown": 0
        },
        {
          "metric": "security_testing",
          "label": "Security-testing tool or text signal",
          "observed": 18,
          "not_detected": 25,
          "unknown": 7
        },
        {
          "metric": "release_lineage",
          "label": "Published release reference observable",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        }
      ]
    },
    {
      "ecosystem": "Java/JVM",
      "sample_size": 50,
      "metrics": [
        {
          "metric": "manifest",
          "label": "Dependency manifest detected",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        },
        {
          "metric": "lockfile",
          "label": "Lockfile detected",
          "observed": 16,
          "not_detected": 32,
          "unknown": 2
        },
        {
          "metric": "sbom",
          "label": "Repository SBOM document detected",
          "observed": 0,
          "not_detected": 48,
          "unknown": 2
        },
        {
          "metric": "cyclonedx",
          "label": "CycloneDX JSON detected",
          "observed": 0,
          "not_detected": 48,
          "unknown": 2
        },
        {
          "metric": "spdx",
          "label": "SPDX JSON detected",
          "observed": 0,
          "not_detected": 48,
          "unknown": 2
        },
        {
          "metric": "security_md",
          "label": "SECURITY.md detected",
          "observed": 14,
          "not_detected": 36,
          "unknown": 0
        },
        {
          "metric": "reporting_contact",
          "label": "Reporting-contact text signal",
          "observed": 11,
          "not_detected": 34,
          "unknown": 5
        },
        {
          "metric": "disclosure_process",
          "label": "Disclosure-process text signal",
          "observed": 4,
          "not_detected": 37,
          "unknown": 9
        },
        {
          "metric": "security_updates",
          "label": "Security-update text signal",
          "observed": 2,
          "not_detected": 37,
          "unknown": 11
        },
        {
          "metric": "support_eol",
          "label": "Support / EOL text signal",
          "observed": 7,
          "not_detected": 35,
          "unknown": 8
        },
        {
          "metric": "release_process",
          "label": "Release-process text signal",
          "observed": 5,
          "not_detected": 36,
          "unknown": 9
        },
        {
          "metric": "ci_build",
          "label": "CI / build configuration detected",
          "observed": 46,
          "not_detected": 4,
          "unknown": 0
        },
        {
          "metric": "architecture",
          "label": "Architecture / design document detected",
          "observed": 5,
          "not_detected": 43,
          "unknown": 2
        },
        {
          "metric": "security_testing",
          "label": "Security-testing tool or text signal",
          "observed": 7,
          "not_detected": 36,
          "unknown": 7
        },
        {
          "metric": "release_lineage",
          "label": "Published release reference observable",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        }
      ]
    },
    {
      "ecosystem": "Go",
      "sample_size": 50,
      "metrics": [
        {
          "metric": "manifest",
          "label": "Dependency manifest detected",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        },
        {
          "metric": "lockfile",
          "label": "Lockfile detected",
          "observed": 22,
          "not_detected": 28,
          "unknown": 0
        },
        {
          "metric": "sbom",
          "label": "Repository SBOM document detected",
          "observed": 0,
          "not_detected": 49,
          "unknown": 1
        },
        {
          "metric": "cyclonedx",
          "label": "CycloneDX JSON detected",
          "observed": 0,
          "not_detected": 49,
          "unknown": 1
        },
        {
          "metric": "spdx",
          "label": "SPDX JSON detected",
          "observed": 0,
          "not_detected": 49,
          "unknown": 1
        },
        {
          "metric": "security_md",
          "label": "SECURITY.md detected",
          "observed": 31,
          "not_detected": 19,
          "unknown": 0
        },
        {
          "metric": "reporting_contact",
          "label": "Reporting-contact text signal",
          "observed": 16,
          "not_detected": 23,
          "unknown": 11
        },
        {
          "metric": "disclosure_process",
          "label": "Disclosure-process text signal",
          "observed": 12,
          "not_detected": 28,
          "unknown": 10
        },
        {
          "metric": "security_updates",
          "label": "Security-update text signal",
          "observed": 7,
          "not_detected": 29,
          "unknown": 14
        },
        {
          "metric": "support_eol",
          "label": "Support / EOL text signal",
          "observed": 25,
          "not_detected": 18,
          "unknown": 7
        },
        {
          "metric": "release_process",
          "label": "Release-process text signal",
          "observed": 14,
          "not_detected": 29,
          "unknown": 7
        },
        {
          "metric": "ci_build",
          "label": "CI / build configuration detected",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        },
        {
          "metric": "architecture",
          "label": "Architecture / design document detected",
          "observed": 7,
          "not_detected": 42,
          "unknown": 1
        },
        {
          "metric": "security_testing",
          "label": "Security-testing tool or text signal",
          "observed": 24,
          "not_detected": 21,
          "unknown": 5
        },
        {
          "metric": "release_lineage",
          "label": "Published release reference observable",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        }
      ]
    },
    {
      "ecosystem": "Rust",
      "sample_size": 50,
      "metrics": [
        {
          "metric": "manifest",
          "label": "Dependency manifest detected",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        },
        {
          "metric": "lockfile",
          "label": "Lockfile detected",
          "observed": 47,
          "not_detected": 3,
          "unknown": 0
        },
        {
          "metric": "sbom",
          "label": "Repository SBOM document detected",
          "observed": 0,
          "not_detected": 49,
          "unknown": 1
        },
        {
          "metric": "cyclonedx",
          "label": "CycloneDX JSON detected",
          "observed": 0,
          "not_detected": 49,
          "unknown": 1
        },
        {
          "metric": "spdx",
          "label": "SPDX JSON detected",
          "observed": 0,
          "not_detected": 49,
          "unknown": 1
        },
        {
          "metric": "security_md",
          "label": "SECURITY.md detected",
          "observed": 25,
          "not_detected": 25,
          "unknown": 0
        },
        {
          "metric": "reporting_contact",
          "label": "Reporting-contact text signal",
          "observed": 10,
          "not_detected": 21,
          "unknown": 19
        },
        {
          "metric": "disclosure_process",
          "label": "Disclosure-process text signal",
          "observed": 9,
          "not_detected": 23,
          "unknown": 18
        },
        {
          "metric": "security_updates",
          "label": "Security-update text signal",
          "observed": 6,
          "not_detected": 22,
          "unknown": 22
        },
        {
          "metric": "support_eol",
          "label": "Support / EOL text signal",
          "observed": 13,
          "not_detected": 22,
          "unknown": 15
        },
        {
          "metric": "release_process",
          "label": "Release-process text signal",
          "observed": 19,
          "not_detected": 16,
          "unknown": 15
        },
        {
          "metric": "ci_build",
          "label": "CI / build configuration detected",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        },
        {
          "metric": "architecture",
          "label": "Architecture / design document detected",
          "observed": 13,
          "not_detected": 37,
          "unknown": 0
        },
        {
          "metric": "security_testing",
          "label": "Security-testing tool or text signal",
          "observed": 24,
          "not_detected": 17,
          "unknown": 9
        },
        {
          "metric": "release_lineage",
          "label": "Published release reference observable",
          "observed": 50,
          "not_detected": 0,
          "unknown": 0
        }
      ]
    }
  ]
}