We should have some documentation for #1846 explaining: * how to use the CLI flags * how to use the fields programmatically * how to have the scanner run just your own custom extractor * how to match the existing scanner behaviour + your own extractor It's probably best though to wait until we've landed some of the other changes as they'll simplify what we need to document by removing edge cases. Also see https://github.com/google/osv-scanner/pull/1846/commits/8edae54f46cb62a34bb4859d2691b0097f5c0c8f#diff-f6e4ddeec588fb949027adbba185137af1f443ceb182b703b70e14e9c0715f7c for some rough notes I put together at the time