docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei)

CVE matching is done directly against OSV.dev (by purl) and NVD (CVSS, CODESYS
CPE) in pipeline/cve.rs; Grype is not installed or invoked. DAST/pentest use the
in-house compliance-dast agents, not ZAP or nuclei. Found while reconciling the
Certifai requirements spec (Collectives) with the code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

docs/guide/findings.md

@@ -26,7 +26,7 @@ Filters can be combined. Results are paginated with 20 findings per page.
 | Severity | Color-coded badge: Critical (red), High (orange), Medium (yellow), Low (green), Info (blue) |
 | Title | Short description of the vulnerability (clickable) |
 | Type | SAST, SBOM, CVE, GDPR, OAuth, Secrets, or Code Review |
-| Scanner | Tool that found the issue (e.g. Semgrep, Grype) |
+| Scanner | Tool that found the issue (e.g. Semgrep, Syft/OSV) |
 | File | Source file path where the issue was found |
 | Status | Current triage status |
 
@@ -73,7 +73,7 @@ If the finding has been pushed to an issue tracker (GitHub, GitLab, Gitea, Jira)
 | Type | Source | Description |
 |------|--------|-------------|
 | **SAST** | Semgrep | Code-level vulnerabilities found through static analysis |
-| **SBOM** | Syft + Grype | Vulnerable dependencies identified in your software bill of materials |
+| **SBOM** | Syft + OSV.dev/NVD | Vulnerable dependencies identified in your software bill of materials |
 | **CVE** | NVD | Known CVEs matching your dependency versions |
 | **GDPR** | Custom rules | Personal data handling and consent issues |
 | **OAuth** | Custom rules | OAuth/OIDC misconfigurations and insecure token handling |

docs/guide/sbom.md

@@ -6,7 +6,7 @@ The SBOM (Software Bill of Materials) feature provides a complete inventory of a
 
 A Software Bill of Materials is a list of every component (library, package, framework) that your software depends on, along with version numbers, licenses, and known vulnerabilities. SBOMs are increasingly required for compliance audits, customer security questionnaires, and supply chain transparency.
 
-Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and Grype for vulnerability matching.
+Certifai generates SBOMs automatically during each scan using Syft for dependency extraction and OSV.dev + NVD for vulnerability matching.
 
 ## Packages Tab
 

docs/guide/scanning.md

@@ -8,7 +8,7 @@ When a scan is triggered, Certifai runs through these phases in order:
 
 1. **Clone** -- pulls the latest code from the Git remote (or clones it for the first time)
 2. **SAST** -- runs static analysis using Semgrep with rules covering OWASP, GDPR, OAuth, secrets, and general security patterns
-3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via Grype
+3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via OSV.dev + NVD
 4. **CVE Check** -- cross-references dependencies against the NVD database for known CVEs
 5. **Graph Build** -- parses the codebase to construct a code knowledge graph of functions, classes, and their relationships
 6. **AI Triage** -- new findings are reviewed by an LLM that assesses severity, considers blast radius using the code graph, and generates remediation guidance
@@ -52,7 +52,7 @@ A full scan runs multiple analysis engines, each producing different types of fi
 | Scan Type | What It Detects | Scanner |
 |-----------|----------------|---------|
 | **SAST** | Code-level vulnerabilities (injection, XSS, insecure crypto, etc.) | Semgrep |
-| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + Grype |
+| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + OSV.dev/NVD |
 | **CVE** | Known CVEs in dependencies cross-referenced against NVD | NVD API |
 | **GDPR** | Personal data handling issues, consent violations | Custom rules |
 | **OAuth** | OAuth/OIDC misconfigurations, insecure token handling | Custom rules |