NVD gives you the current record. CASCA gives you the record over time.
Why the evidence holds together
Changed-since triage, search, dossiers, source comparison, and evidence receipts are the daily workhorse. Explorer and the bounded Constellation support evidence-backed investigation without replacing those workflows.
Public source evidence preserves identity, source attribution, observation time, corrections, conflicts, and unknowns. See Sources for declared coverage and Operations for freshness and operating posture.
How this was built
Cascade Atlas retains public source assertions with their authorship, upstream origin, and lineage. It records that evidence in timestamped, immutable snapshots so a later update does not silently rewrite an earlier view.
PostgreSQL holds the evidence history, and a server-rendered public application turns it into search, queues, dossiers, comparisons, and feeds. Snapshot-bound receipts carry the displayed claims and limits into tickets or investigations. Check Your List extracts and matches pasted CVE IDs in the browser, without sending the pasted text.
Operational controls remain private. Application releases are built from an explicit package boundary, checksummed, installed immutably, and selected with a retained predecessor and a tested recovery path.
Declared boundaries
CASCA is not a scanner or customer-risk system. It cannot decide whether your environment is affected or safe.