New CVEs reach old builds
Matching runs on our side, so each new advisory rechecks every scan you keep. You get an alert by email, Slack, or webhook when a package you already ship becomes vulnerable.
SecureChain by TuxCare
Find the vulnerable dependencies you ship. Fix them without a rewrite.
One command scans the lockfiles of your project. SecureChain checks every package against each new advisory, keeps checking after the build, and tells you the exact fix: an upgrade, or a TuxCare build of the version you already use.
- Free workspace
- No credit card
- Your own address at name.sc.tuxcare-staging.work
acme/storefront main
1Critical
1High
1Medium
212Clean
- Critical log4j-core 2.14.1 CVE-2021-44228 Known exploited
- High lodash 4.17.20 CVE-2021-23337 Fix 4.17.21
- Medium requests 2.25.1 CVE-2023-32681 Fix 2.31.0
Set up
Your first findings in five minutes
The CLI is one file for Linux, macOS, and Windows. It needs one secret: an access token of your workspace.
# install (Linux, macOS; or npm, pipx, Homebrew)
curl -fsSL https://securechain.tuxcare.com/get/securechain | sh
# sign in with your browser, one time
securechain auth login
# scan the project in this directory
securechain sca# SECURECHAIN_PORTAL_TOKEN is a masked CI variable
securechain:
script:
- curl -fsSL https://securechain.tuxcare.com/get/securechain | sh
- securechain sca --fail-on highRead the setup guide: GitHub Actions, GitLab CI, Jenkins, and any other CI system.
How it works
Scan, match, fix, gate
-
1
Scan
The CLI reads the lockfiles of your project and sends the package names and versions. It never sends source code.
-
2
Match
The portal matches the packages with the advisory data and keeps the scan. A new CVE rechecks every stored scan: no rescan, no new build.
-
3
Fix
The fix plan names the version to move to.
securechain hardenmoves you to TuxCare builds: the same versions, with the fixes. -
4
Gate
Fail a build on high findings, or fail a pull request only on the findings that it adds.
Features
Built for the people who fix the code
Pull requests fail on what they add
securechain compare --fail-on-new compares a branch with its base. Old findings do not block new work. New ones do.
A fix plan, not a list
Each repository gets the package upgrades that close the most findings. Known-exploited vulnerabilities come first, and each finding has a fix deadline.
Fixes without a major upgrade
TuxCare builds packages from source and adds the security fixes to the version you use, also after the project stops supporting it. harden applies them and checks the result.
Triage one time
A decision stays with the finding in later scans. CI can skip what your team ignored, and each release exports a VEX file for your customers.
Fits your toolchain
SARIF for code scanning, JSON and Markdown for scripts and pull requests, a REST API, and an MCP server for AI assistants such as Claude Code and Cursor.
Your code stays with you
The CLI sends a package list, nothing more
What it sends
- The name and version of each package
- The repository URL, branch, and commit
- The path of the project in the repository
What it never sends
- Source code or file contents
- Environment variables or secrets
- A user name or password in the repository URL
securechain sbom --preview shows the exact upload, and sends nothing.
Languages
Works with the package managers you use
SecureChain reads the lockfile that your package manager writes, and compares versions with the rules of each ecosystem.
- JavaScript and TypeScript npm, pnpm, Yarn, Bun, Deno
- Python pip, uv, Poetry, PDM, Pipenv, conda
- Java and Kotlin Maven, Gradle
- Go Go modules
- Rust Cargo
- Ruby Bundler
- .NET NuGet
- PHP Composer
- And more Elixir, Dart, Swift, Haskell, R, C and C++
Scan your first project today
Create a free SecureChain workspace in under a minute. No credit card.