Supply chain security, written plainly.
Research, analysis, and operator-grade guides from the team building Rorix. Bias toward things that are actually happening, not industry theater.
A Trusted NuGet Registry Is a Policy Decision, Not a Cache
Why controlling package restore requires provenance evidence, publication gates, and explicit fallback—not just faster downloads.
Verify the Target Before You Start the Scanner
Target authorization is not paperwork around a pentest—it is part of the security boundary of the testing platform.
AI Code Analysis Needs a Security Boundary of Its Own
Source analysis processes sensitive, adversarial input. The pipeline needs isolation, consent, budgets, and deletion controls.
Vulnerability Alerts Are Not a Triage Plan
A practical way to turn a crowded dependency scan into an ordered, explainable remediation queue.
What a Reproducible NuGet Build Actually Proves
Rebuilding a package from source can establish a powerful chain of evidence—as long as its conclusion is not overstated.
Continuous Pentesting Needs a Safe Operating Envelope
Frequent security testing becomes sustainable when scope, methods, budgets, coverage, and enforcement are deliberately bounded.
The NuGet Risk You Did Not Add Directly
Why transitive dependencies deserve first-class review, and how to remediate them without creating a maze of overrides.
A Security Finding Is a Claim, Not a Verdict
How evidence, revalidation, coverage, and stable lifecycles make code-analysis results useful to developers.
CycloneDX or SPDX? Choose the SBOM Your Consumer Can Use
A practical guide to selecting an SBOM format for security operations, compliance, and customer delivery.
License Policy Without Blocking Every Pull Request
How to turn open-source license review into a predictable engineering control instead of a last-minute legal fire drill.
How to Roll Out Dependency Scanning in CI Without Creating Alert Fatigue
A staged playbook for introducing .NET dependency gates that developers will trust and maintain.
Introducing Rorix: Supply Chain Security for .NET
We're launching Rorix — a purpose-built security platform for .NET ecosystems.