rorixrorix
dashboard →
Back to blog
|Authaz Team

Introducing Rorix: Supply Chain Security for .NET

launchsecurity.net
Connected package nodes converging around a secured central software core

Introducing Rorix

September 2026 update: Rorix is operating as a capacity-limited public preview. Rorix.Cli 0.1.2, GitHub Actions, and the Azure DevOps extension are publicly available; the GitHub App remains under its separate release gate.

The .NET ecosystem powers some of the most critical software in the world — banking systems, healthcare platforms, enterprise infrastructure. Yet when it comes to supply chain security tooling, .NET has been an afterthought. Most vulnerability scanners treat NuGet as a secondary concern, bolted on as an extension to tools built primarily for npm or PyPI. We built Rorix to change that.

Why .NET Needs Dedicated Tooling

NuGet packages have a unique dependency resolution model, a distinct versioning scheme, and their own set of supply chain risks. Generic scanners miss transitive dependency vulnerabilities that are specific to how .NET resolves package graphs. They lack context on .NET-specific attack vectors like assembly binding redirects, runtime identifier mismatches, and framework-targeted vulnerabilities that only affect certain TFMs.

Rorix parses common .NET manifests and lock files and enriches resolved package versions with NuGet advisory metadata, OSV identifiers, and EPSS data where available.

What's Included

The public preview includes the public CLI, GitHub Actions, Azure DevOps task, and the core web workflows below:

  • Vulnerability Scanning — real-time analysis of your dependency graph against multiple advisory sources, with severity scoring and exploitability metrics
  • SBOM Generation — produce CycloneDX and SPDX software bills of materials for compliance and auditing
  • License Compliance — define allowlist and blocklist policies for open-source licenses, with automatic enforcement in CI/CD
  • Dependency Graph Visualization — interactive exploration of your full transitive dependency tree, highlighting vulnerable paths
  • Docker Analysis — scan container images for .NET-specific vulnerabilities in base images and application layers
  • Policy Enforcement — codify your security requirements in a .rorix.yml file and enforce them automatically

Getting Started

Install the CLI from NuGet.org:

dotnet tool install -g Rorix.Cli

Run your first scan:

rorix scan ./MyProject.sln

See the CLI quickstart for authentication and supported manifest types. The Azure DevOps extension is available in public preview; the public GitHub App remains unavailable until its separate release gate passes.

Related guides