Check dependencies and supply chain

Most of the code you ship is code you didn't write , your dependencies. OpenThunder gives you a keyless, deterministic view of what's in your tree and lets you prove that the artifacts you ship match the source they came from.

Inventory what you depend on

openthunder sbom

Generates a CycloneDX SBOM , every resolved dependency plus its integrity digest , from the lockfile. No network call, no AI key.

Prove release artifacts match the source

For the publisher side (binding what you ship to the commit it was built from):

openthunder checksums          # a SHA-256 manifest for release artifacts
openthunder provenance         # SLSA-style build provenance binding artifacts to the source commit

For the consumer side (verifying a download you received):

openthunder verify-artifacts   # verify downloads against a published checksum manifest (exit 1 on any mismatch)

Fold it into the trust posture

openthunder security check     # fails on new critical findings, secrets, unauthenticated protected routes
openthunder trust-report       # boundary + supply-chain + evidence, as an honestly-labeled capability matrix

The trust report is deliberately honest: each capability is labeled by what's actually verified versus not, so you never present an untested control as a guarantee.