Support for Security Vulnerability Sources Beyond Traditional Advisory Feeds

[wataltera]

Dependency Track imports and reports vulnerability data from NVD and GitHub Advisories. Could the current DT architecture import security findings from other sources? For example:

Component-level findings from SAST products such as Fortify, Checkmarx, and GitHub Advanced Security Code Scanning (CodeQL).
Application-level findings from DAST tools such as Rapid7, OWASP ZAP, and manual penetration testing.
Security requirements and control frameworks such as OWASP ASVS, where individual requirements could be tracked: in_triage, resolved, exploitable, not_affected, or false_positive with an auditable explanation.

One approach might be importing such findings through CycloneDX VEX (or related CycloneDX constructs) generated by third-party tooling, with the originating tool identified in the metadata.

How compatible is this vision with the current DT architecture? Would supporting these types of external security finding sources primarily require:

New importers/connectors?
Changes to the vulnerability or finding data model?
Changes to correlation logic?
A larger architectural change?

Has the project previously discussed a roadmap or design direction for incorporating non-advisory security findings into Dependency Track?