OpenClearFor OpenClear 1.31.0, released 2026-10-29: part of the due-diligence pack (third-party risk). Each release's notes on GitHub carry the same figures for that release.
- ASVS 5.0: 214 of 242 applicable requirements met (88%), 8 partly, 5 not met, 15 the service provider's (crosswalk).
- Advisories fixed: none.
- Dependencies: 109 pinned at runtime; their releases' median age is 51 days; 21 are over a year old; 12 have a newer release (Dependabot and the weekly lock refresh propose them; one with a known vulnerability fails the build).
- SBOM: openclear-1.31.0.cdx.json (CycloneDX).
Every change also passes CodeQL, Bandit, gitleaks, pip-audit and an OWASP ZAP baseline scan; ZAP's active scan runs weekly. How vulnerabilities are reported and how fast they're fixed: SECURITY.md.
Built from docs/compliance/security-metrics.md in the OpenClear repository. Last changed October 29, 2026.