SecureChain user guide

SecureChain tells you which open-source dependencies of your projects have known vulnerabilities, how to fix each one, and when a new advisory affects code that you already ship. You run one small CLI on your computer or in CI. The portal does the rest.

What SecureChain does #

It scans

The securechain CLI reads the lockfiles of your project and sends the list of packages and versions to your workspace. It does not send source code.

It matches

The portal compares the list with the advisory data (for example CVE, GHSA, and OSV records) and keeps the scan. When a new advisory comes out, the portal checks every stored scan again. You learn about a new vulnerability without a new build.

It tells you what to fix first

Each finding has a severity, a fix deadline, and a known-exploited flag. The fix plan names the version to move to. When TuxCare has a build of the same version with the fix, the plan names that build.

It fixes

securechain harden moves a project to TuxCare builds: the same versions that you use now, with the security fixes added. You do not upgrade to a new major version to close a CVE.

It gates

In CI, the CLI can fail a build on a high finding, or fail a pull request only on the findings that it adds.

Each organization has its own workspace, for example acme.sc.tuxcare.cloud. Nobody outside the workspace sees its repositories, scans, or findings.

How it works #

1. The CLI sends the package list. securechain sca reads the lockfiles and sends the names and versions of the packages to your workspace.
2. The portal answers with the findings. The CLI prints them and can fail the CI job. The portal shows the same findings, with the fix plan, in the browser.
3. The portal gives the CLI the registry credential. You need only one secret: the access token of your workspace. The CLI gets the credential of the TuxCare registry with it. You need this step only for TuxCare builds.
4. Your package manager downloads the TuxCare builds. securechain harden points the project at the builds. npm ci, pip install, and the other install commands then get them from the TuxCare registry.

After the first scan, the portal works without you. When a new advisory affects a package that you ship, the portal shows the new finding and sends an alert by email, Slack, or webhook.

What leaves your computer #

The CLI sends only these items:

• The package URL (name and version) of each dependency, and how it reaches your project (direct or transitive).
• The repository URL, the branch, the commit, and the path of the project in the repository. The CLI removes a user name or a password from the URL.
• The version of the CLI.

It never sends source code, file contents, or environment variables. To see the exact upload before you send it, run securechain sbom --preview. It writes the upload to the screen, sends nothing, and needs no token.

Languages and package managers #

The CLI also reads the lockfiles of some other package managers. The portal shows their packages as Not assessed: it has no advisory data to check them. A package that is not assessed is not clean.

Where to start #

Next: Get started