Worked on the coder/trivy repository to deliver initial VEX integration through SBOM references, enabling the tool to load and incorporate external VEX files into its vulnerability analysis workflow. This involved modifying the SBOM core to support referencing and parsing external VEX data, laying the groundwork for more accurate vulnerability assessments and improved remediation readiness. The work required in-depth use of Go for development, CycloneDX for SBOM handling, and Markdown for updating documentation to reflect the new integration. The focused effort resulted in a cohesive feature set that aligns Trivy’s analysis with SBOM-driven risk management practices without addressing major bugs.