Thomas Grininger developed the initial VEX integration for the coder/trivy repository, enabling Trivy to load and incorporate external VEX files referenced in SBOMs for enhanced vulnerability analysis. He modified the SBOM core to support external data sources and established the groundwork for VEX data parsing, ensuring that vulnerability assessments could leverage up-to-date external information. His work included updating documentation to guide users on the new integration and usage patterns. Utilizing Go and Markdown, along with CycloneDX and SBOM expertise, Thomas delivered a focused, end-to-end feature that improved Trivy’s alignment with SBOM-driven risk workflows without addressing major bugs.