RORIX SECURITY
See the risk.
Behind every dependency.
See beyond your manifest. Uncover vulnerable dependencies, review package risk, and know what goes into every release.
NUGET + NPM · DIRECT + TRANSITIVE DEPENDENCIES
DEPENDENCY MAP
NuGetExample.Json 2.4.0
An affected version enters through your payments dependency.
INTRODUCED BY
A next step, with context.
Review the advisory and update the parent package to resolve a patched version.
// BELOW THE SURFACE
Small packages.
Real consequences.
A dependency can introduce another vulnerable package, an unfamiliar license, or a name that warrants a closer look. Explore what each signal means and what to do next.
RESOLVED DEPENDENCY PATH
HIGH · ADVISORY MATCH
The package you didn’t add still ships.
A direct dependency brings in a version affected by a security advisory. The dependency path shows where it enters your application.
EVIDENCE
Affected version + advisory + dependency path
NEXT STEP
Review the advisory and update the parent dependency to a release that resolves a patched version.
// FROM FINDING TO DECISION
From a dependency graph
to a decision you can make.
Resolve the dependencies
Start with your project or lockfile. Identify direct packages and the transitive dependencies they introduce.
Review the risk
Bring advisory matches, severity, license findings, and package identity signals into one review workflow.
Apply your policy
Use policy results to guide updates and reviews. Export an SBOM to document the packages in your application.
// BUILT INTO YOUR WORKFLOW
One workflow.
Every place you build.
Scan locally, add checks to CI, and keep an inventory of your dependencies. Give your team a shared basis for reviewing what ships.
Set up GitHub Actions →In your pull request
Bring scan results into the code review workflow.
Explore the GitHub integration →In your inventory
Export CycloneDX or SPDX SBOMs for downstream review.
Explore supply chain capabilities →Before your first scan.
What does dependency scanning cover?
Dependency scanning checks package versions against security advisories and surfaces license and package identity signals. Explore the Supply Chain page for supported formats, SBOM exports, and policy configuration.
Does a vulnerable dependency mean my application is exploitable?
An advisory match identifies an affected package version. Whether your application can be exploited depends on how it uses that package. Review the advisory and application context before deciding on remediation.
Which ecosystems can I scan?
Rorix supports NuGet and npm dependency scanning. Visit the Supply Chain page for supported project and lockfile formats.
Can I use Rorix in CI?
Yes. Use the CLI or GitHub Actions integration to bring dependency scanning and policy evaluation into your delivery workflow. The documentation covers setup and configuration.
// START WITH YOUR DEPENDENCIES