New snippet-level scanning shows security and compliance leaders which open-source code and which AI-written code never made it into a manifest.