:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!
Deterministic file observation for pipelines — one read-only pass over a directory emits a reproducible JSON manifest of every file's type, metadata, structure, and provenance.
Pure-Go (no cgo) C2PA / Content Credentials library for JPEG & PNG: a fast unverified reader plus full cryptographic validation (signature, cert chain, hash bindings, RFC 3161 timestamp).
A deterministic local configuration resolution engine with value-level provenance tracking, validation boundaries, and secret redaction for TypeScript/Node.js.