rorixrorix
dashboard →

Application security
for modern
engineering teams.

Scan NuGet and npm dependencies for vulnerabilities, generate SBOMs, and check license compliance. Add verified pentesting and package provenance controls as your security workflow grows.

Start scanning→View sample reportSee how Rorix compares with Dependabot →
~/rorix/scan · net8.0
$
dependency graph · 33 shown / 847 total● 3 vulnerable paths
vulnerablecleanpath

Every finding starts with a package. Follow its dependency path, review the risk, and choose your next step.

Explore vulnerability scanning →
// 01 · PRODUCTS

Start with supply chain. Expand when you need more.

The buying wedge is straightforward: secure NuGet usage first, then layer on source review, runtime testing, and stricter package controls.

Supply Chain

Audit NuGet dependencies the way .NET teams actually work: full graph resolution, SBOM export, license controls, typosquat detection, and CI-ready workflows.

NuGet vulnerability audits with EPSS context
CycloneDX and SPDX SBOM exports
License policy and ownership controls
Typosquat and dependency-confusion signals
Dependency graph with vulnerable path tracing
Release-candidate CLI and CI workflow sources
// live audit · MyApp.Web.csprojscanning…
OKNewtonsoft.Json13.0.30 vulns
CRITSystem.Text.Json6.0.0CVE-2024-30105 · 9.8
HIGHAzure.Identity1.10.0CVE-2024-21386 · 7.5
OKSerilog3.1.10 vulns
MEDIdentityServer44.1.2EOL · 6.5
OKEntityFrameworkCore8.0.20 vulns
OKAutoMapper12.0.10 vulns
Scan your project →See the .NET comparison

Pentesting

Run verified scans against the apps and APIs you own. Useful after you have dependency visibility in place.

  • ›DNS-based domain verification
  • ›Curated HTTP checks plus API testing
  • ›Structured executive reports
Run a pentest →

Registry

A controlled NuGet intake layer with provenance, allowlists, and policy enforcement before packages reach production.

  • ›Package approval workflows
  • ›Provenance and rebuild checks
  • ›Organization policy controls
Govern packages →

Code Analysis

PRIVATE BETA

Analyze .NET source with DeepSec in isolated sandboxes, revalidate likely vulnerabilities, and return reviewable findings without turning an experimental signal into a merge blocker.

source-awarePR checksSARIF exporthuman triage
Explore Code Analysis →
// finding · AccountController.csHIGH

Authorization check may trust a user-controlled tenant identifier

confidencerevalidated · 0.91locationlines 84–97actionhuman review queued
// 02 · WORKFLOW

From scan to fix in minutes

A complete security workflow that plugs into the repos and pipelines you already run.

Scan NuGet and npm manifests

Upload a .csproj or npm lockfile, connect a repository, or trigger via CI. Rorix resolves exact npm dependencies and the full .NET graph across target frameworks.

  • ●.csproj, .sln, packages.config
  • ●Directory.Packages.props, global.json
  • ●package.json, package-lock.json, npm-shrinkwrap.json
discovered 5 files · 989 packages resolved
✓01src/Api/Contoso.Web.Api.csproj142 pkgs
✓02src/Core/Contoso.Core.csproj89 pkgs
✓03tests/Contoso.Tests.csproj47 pkgs
✓04Directory.Packages.props12 pkgs
✓05global.json5 pkgs
// 03 · CAPABILITIES

Everything you need to ship securely

Dependency scanning today. Runtime testing and registry governance when you're ready to expand.

CRITICAL1HIGH3MED3LOW3CVSS v3.1
10.07.55.02.50
9.8
8.1
7.5
7.2
6.5
5.4
4.8
3.7
3.1
2.4
Json
Json
Identity
Sql
IdentityServer4
File
AutoMapper
Polly
FluentValidation
MediatR

Vulnerability Scanning

Dependency audit with CVSS scores, CWE IDs, fix versions, and remediation guidance using NuGet advisory metadata, OSV identifiers, and EPSS enrichment.

{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"components": 989
}

SBOM Generation

CycloneDX 1.6 and SPDX 2.3 with full license data included.

MIT412
Apache-2.0318
BSD-3104
AGPL-3.02
Unknown8

License Compliance

Classify licenses as permissive, copyleft, or unknown. Enforce allowlist and blocklist policies.

Newtonsof.Json
│
distance 1
│
Newtonsoft.Json

Typosquatting Detection

Levenshtein distance analysis against top NuGet packages to catch malicious name squatting.

Dependency Graph

Interactive visualization of your full dependency tree with transitive path highlighting.

.csproj.slnpackages.configDirectory.Packages.propsglobal.jsonnuget.config.deps.json

NuGet + npm Formats

.csproj, .sln, packages.config, Directory.Packages.props, package.json, package-lock.json, npm-shrinkwrap.json.

gradeA
vulns0

Embeddable Badges

SVG badges for your README showing live security grade and vulnerability count.

✓ PR #482 — scan passed
✗ PR #481 — 2 critical
✓ PR #480 — scan passed
⚠ PR #479 — 1 license warn

GitHub Action

Release-candidate source for PR audits and policy gates. Public marketplace distribution is coming soon.

// 04 · DEVELOPER SURFACES

Lives where your team already works

The public CLI and private-preview GitHub checks use the same findings, grades, and policies.

GITHUB APP · PRIVATE PREVIEW

Every pull request, reviewed.

The GitHub App integration is in launch validation with selected design partners. Public installation will open only after the production app, webhook, and checks flow pass the published smoke test.

  • › Blocking checks on critical/high vulnerabilities
  • › Auto-comments with diff of added & bumped packages
  • › Policy overrides with approval trail
  • › Status badge grade on every PR
!preview simulation / supply-chain— 3 high-severity findingsDetails
✓rorix / sbom— CycloneDX 1.6 generated · 847 components
✓rorix / license— 0 policy violations · 2 unknown
rorix-botcommented on #482just now
▲ Supply chain report · grade D
Found 3 high, 7 medium advisories across bumped packages.
→ System.Text.Json 6.0.0 → 8.0.5 resolves CVE-2024-30105
CLI · AVAILABLE

Scriptable. Pipeable. CI-native.

Install the signed .NET tool from NuGet.org for local scans, scripts, and custom CI pipelines. Each release must pass a public-feed install and command smoke test.

~/acme · Rorix CLI
$ rorix scan ./src --sbom cyclonedx
discovering projects...
▸ Contoso.Web.Api.csproj net8.0 84 deps
▸ Contoso.Core.csproj net8.0 312 deps
▸ Contoso.Tests.csproj net8.0 41 deps
resolving transitive graph... 847 nodes
✗ 3 HIGH System.Text.Json@6.0.0 CVE-2024-30105
✗ 2 HIGH Newtonsoft.Json@12.0.3 CVE-2024-21907
▲ 7 MED see: rorix audit --details
✓ sbom.cdx.json written (847 components)
// 05 · BADGES

Embeddable badges for your README

Show your security posture with live-updating SVG badges. Drop them into any README, wiki, or dashboard.

PREVIEW
rorixA
vulns0
sbomok
licenseok
TRY IT
grade
vulns0
README.mdmarkdown
<!-- Grade badge -->
![rorix](https://rorix.io/api/badge/audit?type=grade&csproj=URL)

<!-- Vuln count badge -->
![vulns](https://rorix.io/api/badge/audit?type=vulns&csproj=URL)

<!-- SBOM available -->
![sbom](https://rorix.io/api/badge/audit?type=sbom&csproj=URL)
●
0
Dependency ecosystems
NuGet + npm
●
0
SBOM standards
CycloneDX 1.6 + SPDX 2.3
●
0
Registry integrity layers
digest · provenance · attestation · signature
●
0
Manifest and solution inputs
covered by parser tests
// 06 · INTEGRATIONS

A transparent integration roadmap

Available, preview, and upcoming integrations are labeled explicitly.

NuGet manifestsAVAILABLE
npm manifestsAVAILABLE
Rorix APIPREVIEW
Trusted registryPRIVATE PREVIEW
Rorix CLIAVAILABLE
GitHub AppCOMING SOON
GitHub ActionsPUBLIC PREVIEW
Azure DevOpsPUBLIC PREVIEW
NuGet manifestsAVAILABLE
npm manifestsAVAILABLE
Rorix APIPREVIEW
Trusted registryPRIVATE PREVIEW
Rorix CLIAVAILABLE
GitHub AppCOMING SOON
GitHub ActionsPUBLIC PREVIEW
Azure DevOpsPUBLIC PREVIEW
NuGet manifestsAVAILABLE
npm manifestsAVAILABLE
Rorix APIPREVIEW
Trusted registryPRIVATE PREVIEW
Rorix CLIAVAILABLE
GitHub AppCOMING SOON
GitHub ActionsPUBLIC PREVIEW
Azure DevOpsPUBLIC PREVIEW
// 07 · ENTERPRISE

Built for security teams

Preview capabilities for organizing access, evidence, policies, and audit activity.

Organization Access

Organization-scoped authentication and member roles keep project access separated by team.

Role-based Access

Scoped permissions for engineers, security, and leadership. Per-repo and per-team controls.

Compliance Evidence

Exportable scan evidence, SBOMs, and immutable snapshots support your own compliance review.

Audit Trail

Every scan, policy change, override, and user action logged with timestamp and actor. SIEM integration via webhooks.

◆ CAPACITY-LIMITED PUBLIC PREVIEW

Scan a NuGet or npm project
in the web preview.

Start with the dependency graph your team already ships. Get vulnerability, SBOM, license, and typosquat coverage without buying a full AppSec platform first.

Start scanning →View sample report
See the current integration status →