Compliance Evidence

Machine-readable evidence for every triaged vulnerability

VEX statements, verification reports, and audit trails, produced automatically as XOR triages your PRs. No manual evidence gathering. Point your auditor at the PR comments.

VEX statements

For every NOT EXPLOITABLE verdict, XOR generates an OpenVEX document:

{
"@context": "https://openvex.dev/ns/v0.2.0",
"author": "XOR Platform <security@xor.tech>",
"statements": [{
  "vulnerability": { "name": "CVE-XXXX-XXXXX" },
  "products": [{ "@id": "pkg:github/your-org/your-repo" }],
  "status": "not_affected",
  "justification": "vulnerable_code_not_present",
  "impact_statement": "Static analysis confirms no call path."
}]
}

Supported formats

CRA Article 13.6 compliance

The EU Cyber Resilience Act requires manufacturers to share vulnerability information in machine-readable format. XOR's VEX output satisfies this requirement:

• Machine-readable: JSON format, parseable by any SBOM or GRC tool
• Structured justification: Includes the specific reason (not just "not affected")
• Product identification: PURL identifiers that match SBOM entries
• Timestamps and versioning: Dated and versioned for audit trails

XOR produces evidence for CRA compliance. It does not certify compliance. That responsibility stays with the product manufacturer. Your organization remains accountable for the content of VEX statements and compliance determinations.

SBOM integration

VEX documents reference products by PURL (Package URL). If your SBOM pipeline produces CycloneDX or SPDX documents, XOR's VEX statements link to the same package identifiers. This allows your compliance tools to automatically enrich SBOMs with verdict information, reducing manual data entry and keeping vulnerability assessments in sync across your infrastructure stack.

Audit trail

Every XOR triage produces:

1. PR comment: structured verdict with metrics (visible in GitHub)
2. VEX document: for not-affected verdicts (downloadable JSON)
3. Verification report: for exploitable verdicts with patching evidence
4. Agent trace: full analysis trajectory, signed with COSE_Sign1

All evidence is timestamped and retained in your GitHub PR history indefinitely. Auditors can trace every verdict back to the CVE, the metrics used, and the remediation taken. This creates a permanent record that satisfies regulatory documentation requirements without manual bookkeeping.