Abstract: Tools and techniques are described to protect private configuration and operation information while obtaining pertinent data about known vulnerabilities of packages, runtimes, and software components of various kinds. Dependencies between software items may be traversed to get more complete vulnerability information. Version numbers and other telemetry about installed components, and operational events from installed components, may be exported from a system while nonetheless protecting the privacy of system-specific details. Privacy protections may include withholding private information from a repository or other vulnerability list source, using truncated hashes or fingerprints to select an obscuring subset of the available vulnerability list, anonymizing telemetry, aggregating telemetry, and other mechanisms.