Deconflict after #3252

Landing #3252 ended up causing a bunch of conflicts on this, more refactored branch. Landing this should bring #3274 back into mergable-land.

This implements @dchan's check in a fairly minimal way. Feel free to improve it.

## Verification

  - [ ] Run `check` against a vulnerable and non-vulnerable host
  - [ ] See the correct results.