// PRODUCT · SUPPLY CHAIN

Scan every package. Before it ships.

Vulnerability scanning, SBOM export, and license policy for NuGet and npm — with deep graph resolution and typosquat detection for .NET.

Start scanning →View sample report

// CAPABILITIES

Four layers of defense, built together

Not an SCA stapled onto an AppSec tool. Purpose-built as one pipeline.

Full graph resolution

Walk the complete transitive tree across target frameworks. No surface-level scanning — we resolve the real graph your CLR loads.

Direct + transitivedependency paths

CVE · EPSS · CWE

Correlate NuGet advisory metadata with OSV identifiers and EPSS exploit prediction so teams can prioritize reachable risk.

OSV + EPSSlive enrichment

SBOM, compliance-ready

CycloneDX 1.6 and SPDX 2.3 with package identities, versions, licenses, download locations, and ecosystem-aware PURLs.

2 formatsCDX 1.6 + SPDX 2.3

Typosquat + confusion

Levenshtein distance against top packages, combined with publisher and namespace fingerprints. Catches lookalikes before they land in main.

Policy signalreview before adoption

// ECOSYSTEMS

Deep on .NET. npm-ready today.

First-class .NET support plus exact npm dependency analysis from package-lock.json and npm-shrinkwrap.json.

.NETstable · core

.csproj.slnpackages.configDirectory.Packages.propsglobal.jsonnuget.config.deps.json

JavaScriptnpm · stable

package.jsonpackage-lock.jsonnpm-shrinkwrap.json

Pythonplanned

requirements.txtpyproject.tomlPipfile.lockpoetry.lock

Containerbeta

DockerfileOCI image tarballdistroless base layers

Goplanned

go.modgo.sum

Rustplanned

Cargo.tomlCargo.lock

// POLICY-AS-CODE

Declarative policies, enforced at PR time

Write one YAML file. Every scan, GitHub Action, and CLI run enforces it consistently. No more per-team interpretation.

rorix.yamlpolicy · strict

version: 1
policy: strict
advisories:  sources: [osv, ghsa, nvd]
  fail_on:
licenses:  allow: [MIT, Apache-2.0, BSD-3-Clause, ISC]
  review: [AGPL-3.0, GPL-3.0, LGPL-3.0]
  warn_unknown: true
typosquat:  distance_threshold: 2
  against: top_1000

ENFORCEMENT · APPLIED TO EVERY PR

blockBlock on any CRIT findingseverity.critical

blockBlock on HIGH with EPSS > 0.5severity.high

warnWarn on unknown licenselicense.unknown

reviewRequire review for AGPL, GPL, LGPLlicense.copyleft

blockBlock distance ≤ 2 to top 1000 packagetyposquat.score

warnWarn on packages < 90 days oldage.new

// HOW WE COMPARE

Not Dependabot. Not Snyk. Rorix.

Dependabot does bumps. Snyk does generalist SCA. We do .NET-native supply chain with typosquat detection, policy-as-code, and a GitHub App that actually reviews, not just opens PRs.

See full comparison →