Get one software product (Market)

The compliance debt of the seats running an engine, summed from the daily seat rollup at its newest snapshot_date (published because the rollup can be a day stale). seats_linked is MANY-TO-MANY with engines — a seat whose hosts run two engines is counted under both — so this figure must never be summed across engines to reach a network total. seats_scored ≤ seats_linked: a linked seat the scan has not covered contributes nothing. open_per_1k is null when the linked seats host no registrations (a certificate finding needs none, and 0 would claim a clean sheet).

The engine's tracked upstream lanes, each with its newest stable release and the current / behind / unknown split of the hosts running it. Null when the engine tracks no upstream feed.

Known advisories by CVSS severity (issue #798). All-zero counts with an empty ids mean TRACKED AND CLEAN; the whole object is null when the lane publishes no advisory feed at all. The two are different statements and must render differently. Verified 2026-09-17: no CVE/GHSA exists for any tracked product, so a clean sheet is the expected day-one answer.

The advisories behind advisories, newest-published first — the detail endpoint only. Null when no lane of the engine has an advisory feed; [] when it has one and upstream has published nothing (issue #798).