docs: strengthen README positioning — hero differentiators, unique combination claim, OWASP threading

README.md

@@ -25,9 +25,9 @@
 
   <table>
     <tr>
-      <td align="center" width="33%"><p>🆓</p><strong>Free to use</strong><br/><sub>No account, no subscription,<br/>no cloud required</sub></td>
-      <td align="center" width="33%"><p>🏠</p><strong>Runs locally</strong><br/><sub>Scans your lockfile on your machine.<br/>Nothing leaves your environment</sub></td>
-      <td align="center" width="33%"><p>⚡</p><strong>Fast</strong><br/><sub>Results in seconds. Local cache keeps<br/>rescans near-instant</sub></td>
+      <td align="center" width="33%"><p>🏆</p><strong>OWASP Incubator Project</strong><br/><sub>Peer-reviewed by the org behind the OWASP Top 10 —<br/>the security standard followed by millions of developers</sub></td>
+      <td align="center" width="33%"><p>🎯</p><strong>Remediation-first</strong><br/><sub>Validated fix commands + parent-aware<br/>transitive guidance — not just CVE IDs</sub></td>
+      <td align="center" width="33%"><p>🔒</p><strong>Runs locally</strong><br/><sub>Nothing leaves your machine — not your<br/>code, not your dependency tree</sub></td>
     </tr>
   </table>
 
@@ -160,6 +160,8 @@ For full CI patterns including offline workflows, git hooks, and scripted automa
 
 ## How it compares
 
+No other free tool combines all of the following: lockfile scanning across npm, pnpm, Yarn, and Bun; parent-aware transitive remediation that tells you which package to upgrade (not just which one is vulnerable); fix version validation before suggesting an upgrade; and a fully offline advisory DB for restricted environments.
+
 | Capability | CVE Lite CLI | npm audit | OSV-Scanner | Snyk CLI | Socket CLI |
 |---|:---:|:---:|:---:|:---:|:---:|
 | JS/TS lockfile scanning | ✅ | ✅ | ✅ | ✅ | ✅ |
@@ -194,7 +196,9 @@ If you maintain an open-source JavaScript or TypeScript project and want CVE Lit
 
 ## Recognized by OWASP
 
-CVE Lite CLI is an [OWASP Incubator Project](https://owasp.org/cve-lite-cli), peer-reviewed and maintained under the Open Web Application Security Project Foundation. Being part of OWASP means:
+OWASP (Open Web Application Security Project) is the globally recognized nonprofit behind the security standards followed by millions of developers worldwide — most notably the [OWASP Top 10](https://owasp.org/www-project-top-ten/), the most widely cited web application security reference in the industry. Organizations from startups to Fortune 500 companies use OWASP guidelines as the foundation of their security programs.
+
+CVE Lite CLI is an [OWASP Incubator Project](https://owasp.org/cve-lite-cli) — reviewed and accepted by the OWASP community as a vendor-neutral, open source security tool. Being part of OWASP means:
 
 - **Peer-reviewed** by security professionals
 - **Community-driven** development and governance
@@ -365,12 +369,14 @@ See the [Offline Advisory DB guide](https://owasp.org/cve-lite-cli/docs/offline-
 
 ## Who uses it
 
-CVE Lite CLI is a good fit for:
+CVE Lite CLI is the only free, OWASP-recognized vulnerability scanner purpose-built for JavaScript and TypeScript that combines validated fix commands, parent-aware transitive remediation, and offline scanning in a single lightweight CLI.
+
+It is a good fit for:
 
-- **Independent developers and OSS maintainers** — quick pre-release check without any platform overhead
-- **Startups and small teams** — lightweight CI gate at no cost
-- **Consultants** — run a scan on a client project in seconds, with a clear fix plan to hand over
-- **Enterprise teams with restricted networks** — offline advisory DB workflow removes the need for runtime outbound calls during scans
+- **Independent developers and OSS maintainers** — quick pre-release check without any platform overhead or cost
+- **Startups and small teams** — lightweight CI gate at no cost, with fix commands ready to run immediately
+- **Consultants** — scan a client project in seconds and hand over a concrete, copy-and-run remediation plan
+- **Enterprise teams with restricted networks** — offline advisory DB removes the need for runtime outbound calls during scans
 - **Teams running npm, pnpm, Yarn, and Bun** — unified scanning across all four package managers in one tool
 
 See the [CI and Workflow Integration guide](https://owasp.org/cve-lite-cli/docs/ci-integration) for concrete patterns across these scenarios.