A PSIRT may test products or services the vendor itself offers, or arrange for them to be tested, for vulnerabilities and other security problems; vulnerabilities found this way should go through the vendor's vulnerability handling processes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.