{
  "program": "Mettle Labs",
  "asOf": "2026-10-15",
  "stats": [
    { "id": "reported",    "label": "Findings reported to vendors", "value": 26 },
    { "id": "engaged",     "label": "Maintainer engaged",           "note": "acknowledged or accepted", "value": 6 },
    { "id": "public",      "label": "Public advisories",            "note": "CVE / GHSA / fix",         "value": 0 },
    { "id": "coordinated", "label": "In coordinated disclosure",    "note": "reported, fix pending",    "value": 26 },
    { "id": "projects",    "label": "Projects",                     "value": 18 },
    { "id": "ecosystems",  "label": "Ecosystems covered",           "value": 4 }
  ],
  "pipeline": [
    { "stat": "reported", "label": "Reported" },
    { "stat": "engaged",  "label": "Maintainer engaged" },
    { "stat": "public",   "label": "Public" }
  ],
  "severity": [
    { "id": "high",   "label": "High",   "value": 18 },
    { "id": "medium", "label": "Medium", "value": 8 }
  ],
  "ecosystems": [
    { "id": "web",      "label": "Web applications",  "value": 12 },
    { "id": "packages", "label": "Language packages", "note": "npm / PyPI", "value": 8 },
    { "id": "kernel",   "label": "Linux kernel",      "value": 5 },
    { "id": "native",   "label": "Native C / C++",    "value": 1 }
  ],
  "published": [],
  "footnote": "Figures are reconciled to our own task evidence: every reported finding has a proof-of-concept or patch on file. A finding is named here only once its fix is merged upstream or an advisory is published, and the public reference is verified. Responsible disclosure comes first."
}