Check dependencies and supply chain

Most of the code you ship is code you didn't write, your dependencies. OpenThunder gives you a keyless, deterministic view of what's in your tree and lets you prove that the artifacts you ship match the source they came from.

Inventory what you depend on

openthunder sbom

Generates a CycloneDX SBOM, every resolved dependency plus its integrity digest, from the lockfile. No network call, no AI key.

Prove release artifacts match the source

For the publisher side (binding what you ship to the commit it was built from):

openthunder checksums          # a SHA-256 manifest for release artifacts
openthunder provenance         # SLSA-style build provenance binding artifacts to the source commit

For the consumer side (verifying a download you received):

openthunder verify-artifacts   # verify downloads against a published checksum manifest (exit 1 on any mismatch)

Fold it into the trust posture

openthunder security check     # fails on new critical findings, secrets, unauthenticated protected routes
openthunder trust-report       # boundary + supply-chain + evidence, as an honestly-labeled capability matrix

The trust report is deliberately honest: each capability is labeled by what's actually verified versus not, so you never present an untested control as a guarantee.