rorixrorix
sign in →

Rorix Documentation

Rorix is a supply-chain security platform for .NET and Node.js applications. It combines vulnerability scanning, software composition analysis, pentesting, and policy enforcement in one workflow.

CI gate warning: the public Rorix.Cli 0.1.2 can report success for blocking findings or a missing manifest. The CLI, GitHub Action (pinned to affected 0.1.1), and Azure DevOps task (pinned to affected 0.1.2) should be advisory-only until a corrected public release and failing-case integration checks are available.

What Rorix Does

  • Vulnerability Scanning — analyze NuGet and npm dependencies against known CVEs and advisories
  • SBOM Generation — produce CycloneDX and SPDX software bills of materials for compliance
  • License Compliance — detect package licenses and flag policy violations
  • Policy Enforcement — define security thresholds; build blocking awaits the corrected public CLI release
  • Pentesting — run curated HTTP-hardening checks and bounded API testing against verified web targets
  • Trusted Registry (private preview) — enforce provenance and security policy with source rebuilds and authenticated upstream fallback
  • Container Security — scan Docker images and ECR registries for vulnerabilities
  • Dependency Graphs — visualize your full dependency tree to understand transitive risk

Getting Started

The public-preview entry points are the dashboard and the public Rorix.Cli package. Follow the CLI quickstart to install the tool and run a scan.

Rorix is being delivered through three interfaces:

  1. Dashboard — the web interface at rorix.io/dashboard for managing projects, viewing results, and configuring settings
  2. CLI — the publicly available rorix command-line tool for local and advisory CI scanning
  3. API (preview) — REST endpoints for programmatic access and custom integrations

Choose Your Integration

| Integration | Status | Best For | |---|---|---| | CLI | Available; advisory CI only | Local development, scripts, and advisory CI scans | | GitHub Actions | Public preview; supply-chain scans advisory only | Automated PR scans, scheduled scans, and verified-target pentests | | Azure DevOps | Public preview; advisory CI only | Marketplace pipeline task for Azure DevOps projects | | Dashboard | Public preview | Team visibility, project management, and quick scans | | API | Preview | Building custom integrations and automation workflows |

Quickstart