@luhring did put together an extensive documentation at
https://github.com/chainguard-dev/vulnerability-scanner-support

wolfi and chainguard container images are Alpine-linux based.

They also provide their own security feeds, based on Alpine's secdb format with an unknown license. See:

• Add wolfi security advisories vulnerablecode#1432
• What is the license of the wolfi and chainguard secdb? wolfi-dev/wolfictl#680