{
  "summary": "Adds a CSAF/VDP disclosure sensor: probes each vendor's standard CSAF discovery location alongside the existing security.txt check, both counting as evidence of a NIS2 Art. 21 coordinated vulnerability-disclosure process, and opens a Risk when a critical vendor has neither. Adds SBOM vulnerability scanning - periodically re-checks each vendor's published SBOM against OSV.dev and opens a Risk Register entry for every finding, notifying the system owner by email and/or Slack/Teams once a finding reaches an admin-configured minimum severity from the new Settings > Notifications tab. When a vendor also publishes a CSAF distribution, findings are cross-checked against the vendor's own VEX advisories and silently skipped when the vendor has classified that exact CVE/purl pair as known_not_affected - matched only by an exact purl hit against the vendor's own product tree, never guessed from a name or version. Adds role-based access control: logging in no longer requires admin-group membership, any directory account can sign in, but a non-admin only sees and manages the systems it owns, while the admin group keeps full access to everything including Settings and the other admin-only pages, which are now hidden from non-admin navigation; a new system's owner is locked to the creating user, and an owner can never reassign ownership. A background security review of this access-control work caught a real IDOR where several create endpoints let a non-admin's client-supplied ID silently overwrite an existing System, Risk, or Contact record - fixed by always issuing a fresh server-generated ID for non-admin sessions."
}