Yeah, having an unencumbered database would make it easy to add a check command to hex, which would be rad.
I saw Sobelow, and it looks like they’ve got some dependency vulnerability data in there in this folder. Don’t want to duplicate work, but I think it might be better to have a database of static files, like other languages do, that Sobelow could then consume?
