1
Scan
Reads the dependencies declared in your manifests (Cargo.toml, package.json, requirements.txt, pyproject.toml, go.mod) and queries the live OSV database for known advisories.
OSV advisory database
NVIDIA Nemotron
Nebius Token Factory
Local-only
Autonomous supply-chain security that finds, suggests, and applies fixes.
Strazh scans your repository's declared dependencies against the live OSV database, shows the manifest → package → advisory path, and uses an NVIDIA Nemotron model on Nebius Token Factory to suggest a grounded fix you can apply locally — with one-click Undo.
For developers and small teams who want to find and fix supply-chain issues without waiting for a security review.
Free to scan. Windows installer available now — macOS and Linux builds are planned.
Demo
See it in action
A short walkthrough: scan a repository, read the attack path, generate a Nemotron suggestion, and apply the fix locally.
How it works
Scan → attack path → suggestion → apply
Strazh runs the whole loop locally. Nothing is pushed, committed, or opened as a pull request.
2
Attack path
For each finding, shows the manifest → package → advisory relationship: which file declares the vulnerable dependency, and the advisory it matched.
3
Nemotron suggestion
An NVIDIA Nemotron model on Nebius Token Factory produces remediation guidance grounded in the advisory metadata — never your source code.
4
Apply & Undo
When the advisory provides a fixed version, apply a single, conservative version bump to the declaring manifest on disk — reversible with one click.
What you get
Grounded, local, and honest
Live OSV data
Every declared dependency with a concrete version is checked against the OSV advisory database in real time — no stale bundled snapshots.
Severity-ranked findings
Critical, High, Medium, Low, and Unknown totals with a recommended-actions list that ranks by severity and shared-package blast radius.
Nemotron remediation
Advisory-grounded fix guidance from NVIDIA Nemotron on Nebius Token Factory, generated on demand and clearly labeled as AI guidance.
Conservative local Apply
Rewrites exactly one dependency version in the declaring manifest, pinning to the advisory's fixed version — with instant Undo.
Local-only by design
No accounts, no cloud sync. Your source never leaves your machine. Only advisory metadata is sent to OSV and Nemotron.
Transparent about limits
Findings are declaration-based, not proof of runtime reachability. Strazh tells you what it checked and what it can't confirm.
Pricing
Start free. Upgrade when you want to fix.
Scanning, findings, attack paths, and AI suggestions are free forever. Pro unlocks one-click local Apply fix (with Undo).
Free
$0
Everything you need to find and understand risk.
- ✓ Unlimited local scans
- ✓ View findings & severity summary
- ✓ Attack-path relationship (manifest → package → advisory)
- ✓ Nemotron fix suggestions
- — Apply fix is Pro-only
Most popular
Pro
$29/month
Everything in Free, plus apply fixes in one click. $249/year (save ~28%).
- ✓ Everything in Free
- ✓ Apply fix — conservative local version bump
- ✓ One-click Undo
- ✓ Priority support
After payment
- Pay via the Get Pro checkout above.
- Receive your license key by email (format
SZ1-…). Keys are sent by email after payment — delivery is not instant, and no account is created. - Paste it into the app: open About → License, enter the key, and click Activate. Once the key is accepted, Apply fix unlocks — all local, no account.
Already downloaded Strazh? You don't need to reinstall — just add your key in About → License.
Download
Get Strazh
Free to download and scan. Windows x64 installers from the latest GitHub release — verify the SHA-256 before running.
Windows
Available
Windows 10/11 (x64). Microsoft Edge WebView2 runtime is required — it's preinstalled on current Windows, and the setup offers to fetch it if missing.
setup.exe SHA-256
E32B68657E9DD033991C49B071A2A2A8B8A482E016473632E318BD5906E42530
E32B68657E9DD033991C49B071A2A2A8B8A482E016473632E318BD5906E42530
.msi SHA-256
4F037201186FAB09295CC3D5A6B9661A5E9D117AC6E63F67786024E775BD38E6
4F037201186FAB09295CC3D5A6B9661A5E9D117AC6E63F67786024E775BD38E6
PS> Get-FileHash .\Strazh_1.0.0_x64-setup.exe -Algorithm SHA256
macOS & Linux
Planned
Strazh is built on Tauri, so macOS and Linux builds are on the roadmap. Want one sooner? Open an issue on GitHub and let us know your platform.
Prefer to build it yourself? Clone the repo and run
npm run tauri build.
Honest by default
What Strazh does — and doesn't — do
This matches the current app behavior. We'd rather be precise than oversell.
Declaration-based, not reachability
A finding means a declared dependency matches an OSV advisory for the scanned version. It does not prove the vulnerable code is reached or exploitable at runtime.
AI guidance, not a tested patch
Nemotron suggestions are advisory-grounded guidance, not a verified fix tested against your project. Review and test before relying on them.
Apply fix is conservative
It rewrites one dependency version in one manifest, locally. If a package appears more than once or uses a complex/workspace form, it refuses and asks you to edit manually.
No remote actions yet
No accounts, no cloud sync, and no automatic pull requests. Everything happens on your machine. Scanning and generating guidance never write to your project.
Find your supply-chain risks in minutes.
Download Strazh, point it at a repository, and see what's hiding in your dependencies.