Precheck release security API

Combine exact-version OSV matches, CISA KEV exposure, licence policy, and malicious-package advisories into one release report. The report never approves a release.

The Precheck release security operation is part of the Software Supply Chain Security API on BRAINIAC.software. Combine exact-version OSV matches, CISA KEV exposure, licence policy, and malicious-package advisories into one release report. The report never approves a release. It is exposed as POST /api/v1/software-security/release-precheck and priced at $0.15 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: OSV public API (api.osv.dev). CISA Known Exploited Vulnerabilities catalog JSON feed. Public npm, PyPI, crates.io, and RubyGems package records for licence identifiers. Limitations: CycloneDX and SPDX JSON are accepted, with a limited XML read of the same fields. Only an exact ecosystem, package name, and version is matched. Similar names are ignored. Affected, unaffected, and unknown version ranges are reported separately. At most 25 components and 40 advisory documents are read per call. Absence of an advisory does not mean a dependency is safe or free of malware. Licence compatibility is judged only against the caller allow and deny lists. EPSS, NVD, deps.dev, and Scorecard are not used by this product. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Match SBOM vulnerabilities, Report dependency risk, Check KEV exposure, Check licence compatibility. Open the group documentation for the full request schema, field notes, and response examples before integrating.