See https://github.com/nexB/vulnerablecode/pull/400 for details: Do we want a top result element and nesting or not? TBD