Open-source work and technical records.

The project lacked schema-conformant Turkish cases with traceable provenance for evaluating multilingual prompt-injection and data-extraction behavior.

Added 300 cases adapted from the AltaySec v0.2 source as individual JSON records with a deterministic manifest, DSGAI mappings, anonymization changes, and record-level hashes and provenance.

The contribution was merged upstream with schema, integrity, canonical-mapping, and duplicate checks included in the package.

There was no shared module for producing repeatable, reviewable system reconnaissance before exploitation.

Added 24 English/Turkish probes across nine categories, conservative response classification, evidence-linked JSONL and Markdown reports, filters, dry runs, and error isolation.

The contribution was merged upstream and closed issue #34; labels were designed as triage signals for human review, not automated vulnerability verdicts.

Stalled or broken targets could appear to produce valid reconnaissance evidence, while reporting and lifecycle paths needed safer boundaries.

Added per-probe deadlines, target-error separation, refusal-only false-positive reduction, strict configuration, shell-free lifecycle handling, real HTTP readiness, deterministic cleanup, and private collision-safe reports.

The hardening was merged upstream. Focused regression coverage and repository quality gates passed; a full Podman/Ollama campaign remained outside the validation boundary.

Security teams lacked a practical starting point for mapping AI products as systems of data, prompts, retrieval, tools, identities, and conventional infrastructure—not just models.

Added an inventory-first primer mapping three AI delivery models, six lifecycle stages, typical artifacts, responsibilities, and security entry points.

The contribution was merged upstream and the primer went live on the OWASP AI Exchange, closing issue #182.

Goal-integrity regressions could not record a deterministic goal event without inferring intent from model output.

Added explicit goal-event support across adapter, runner, CLI, and Python API paths; rejected blank or out-of-context use; preserved existing trace shape when disabled.

The contribution was merged upstream and closed issue #94. The design does not infer intent from model output, tool calls, or metadata.

Node updates from synchronous LangGraph runs could not be preserved as inspectable regression evidence without disturbing the default invoke path.

Added an opt-in stream_mode=updates path, captured assistant messages and tool calls, preserved default invoke behavior, and produced explicit errors for unsupported streams.

The contribution was merged upstream and closed issue #95. Async, token-stream, callback, and subgraph paths were intentionally left out of scope.

Cargo.lock omits source for local/path packages. A source-less Cargo PURL implies crates.io identity, which could make a local workspace package look like an unrelated registry package.

Made PURL generation source-aware, omitted PURLs for local/workspace entries, preserved sourced identity for registry and git packages, and added a path-dependency fixture with regression tests.

The contribution was merged into Syft. It corrects the SBOM identity layer; separate downstream hardening for Grype's name/version matching remains under review.