Release v0.2.1 - #38
Merged
Merged
Conversation
anantshri
commented
Aug 6, 2026
anantshri
commented
Contributor
- Insights page finalization
- Local AI usage
- Author location marking logic updated closing nominatim api replacement #21
- probable fix for github enterprise fix: include GitHub Enterprise internal repositories in scans #37
- local data import fix fix: load bundled full-scan export in demo page #36
…-diligence view Design philosophy: three-column risk-domain breakdown (Security / Operational / Compliance) each with score bar, key stats, and traffic-light badge. Overall grade header with plain-English verdict. - Security Posture: vulns, CVE dwell, malware, dep confusion - Operational Health: EOL, version drift, repo activity, SBOM coverage - License & Compliance: copyleft risk, unknown licenses, pinned actions - Each domain scored 0-100 with color-coded progress bar - Plain-English overall verdict tailored to risk level
…t for execs Design philosophy: universal report-card metaphor. Overall GPA + 6 subjects with letter grades, status badges (Excellent/Good/Fair/Poor), and plain-English comments. Everyone understands a report card. - Vulnerability Management - Dependency Freshness - License Compliance - Code Activity - Supply Chain Security - Maintenance Hygiene - Overall GPA computed from subject grades
…exec summary Design philosophy: absolute minimal — one screen, 6 tiles, one verdict line. No scrolling, no tables, no charts. Designed to fit on a laptop screen or slide within a deck. - Giant grade letter with health score and one-line verdict - 6 metric tiles in 3x2 grid: repos, C+H vulns, EOL, licenses, drift, CVE dwell - Color-coded left-border indicator on each tile (green/yellow/red) - 'Top Concerns' tag cloud shown only when issues exist - 'All clear' message when nothing needs attention
…wered executive analysis Uses Chrome's built-in Prompt API (window.ai.languageModel) to generate natural-language executive briefs from SBOM data. Four analysis modes: - Executive Summary — 2-3 paragraph CISO-facing overview - Risk Deep-Dive — prioritized risk identification with severity context - Recommendations — actionable, data-backed remediation steps - M&A Due Diligence — acquisition-target assessment with deal recommendation Design: - Compact KPI strip always visible - 4 mode-selector pills trigger on-device AI generation - Streaming output with typing cursor - Graceful fallback when AI API unavailable - All processing on-device — zero data leaves the browser - Nav links added across all insight pages for easy access
…lyst Multi-turn chat interface powered by Chrome's Gemini Nano (Prompt API). Users can ask free-form questions about their SBOM analysis data and get natural-language answers grounded in the actual metrics. Key features: - Persistent AI session across multiple turns (conversation history) - Streaming responses with live cursor - 8 suggested questions as quick-start chips - Compact KPI strip always visible for reference - 'New conversation' button to reset context - Session auto-recreation on error - Warning at 25+ exchanges to start fresh - Gemini Nano availability detection with graceful fallback - Syncs analysis selector with other insight pages - All processing on-device — zero data leaves the browser
…ia tool-use Paradigm shift from pre-digested context to on-demand data access. The AI decides what data it needs and calls query_sbom() as a registered tool, like an analyst querying a database. Architecture: - Registers query_sbom() as a Prompt API tool with 12 data types - Agent loop: AI calls function → JS executes → returns results → AI continues - 12 queryable categories: overview, vulnerabilities, dependencies, repositories, licenses, eol, versionDrift, malware, techDebt, supplyChain, perRepo, hygiene, vulnAge - Each query returns structured JSON with human-readable summary - Tool calls shown in UI as log entries for transparency - Max 6 tool-use turns per response to prevent infinite loops - Graceful fallback if tools not supported in current Chrome - Streams final answer with typing cursor
Promote accumulated Unreleased changelog to 0.2, update cache-busters and About version display, and bump actions/checkout to v7.0.1.
v0.2 tag was burned by an erroneous release; re-version all cache-busters, About page, and CHANGELOG header to 0.2.1. Also corrects about.html assets that were missed in the prior bump.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.