RepoAudit software supply chain

RepoAudit. Prove what’s exploitable.

Binary-aware verification that finds real zero-days and ships a working exploit with every one. Under 10% false positives — the industry runs over 50%.

See How It Works Book An Assessment
vs. traditional SCA
  • <10% false positives
  • Deep reachability
  • Zero-day discovery
  • PoC with every finding
Scan api-gateway:2.14.0 payments-worker:7.3.1 ml-inference:0.9.4
cve candidates tracing call graphs reachability generating exploits results results
  • CVE-2024-3094 · xz-utils 5.6.1
  • CVE-2023-44487 · nghttp2 1.55
  • CVE-2024-21626 · runc 1.1.11
  • CVE-2023-4863 · libwebp 1.3.0
  • CVE-2022-42889 · commons-text 1.9
  • CVE-2021-44228 · log4j-core 2.14
  • CVE-2023-2650 · openssl 3.0.8
  • CVE-2024-24790 · go net/netip
  • ZERO-DAY · custom tokenizer.so
  • CVE-2024-27980 · node 20.11
  • CVE-2023-45853 · zlib 1.3
  • CVE-2024-2961 · glibc 2.39

analyzing compiled artifact… tracing call graphs through dependencies… discarding unreachable findings… building proof-of-concept exploits… writing kill-chain + fix… scan complete

  1. scan
  2. reach
  3. prove
Result 2 exploitable Clean · 0 reachable 1 zero-day proven Scanning… Shipped with finding PoC · kill-chain · fix signed attestation PoC · repro command · fix —
The question

Can the software this
agent runs on be trusted?

  • traditional SCA — matches names to CVE lists, buries you in unreachable criticals
  • RepoAudit — proves what is actually exploitable, with a working exploit

Before you trust the agent, trust the substrate underneath it.

How it works

Scan. Reach. Prove.

No source code required. A finding only surfaces if it’s reachable — and every one ships with proof.

  1. 01

    Scan

    Analyzes compiled artifacts, containers and CI/CD output — no source code required.

    binaries · containers · sbom · ci output
  2. 02

    Reach

    Traces call graphs through the full dependency tree. A finding only surfaces if it is actually reachable.

    entrypoint → call graph → vulnerable sink
  3. 03

    Prove

    Ships a working PoC exploit, kill-chain, reproduction command and fix with every finding.

    poc.py · killchain.md · repro.sh · fix.patch
RepoAudit vs.
  • Snyk
  • Socket
  • Endor
  • Black Duck
Any CI/CD · no frontier-model access required
Why it’s different

Evidence, not hedge language.

  • 01 Binary-aware Sees compiled components source-only tools never catch.
  • 02 Reachability-first Only flags what’s actually exploitable in your context.
  • 03 Proof-backed A working exploit with every finding — not a guess.
  • 04 Pipeline-native Deployable in any CI/CD, no frontier-model access required.
Finding fnd_3a91c fnd_77e02 fnd_c14f8
Artifact api-gateway:2.14.0 · xz-utils 5.6.1 payments-worker:7.3.1 · log4j-core 2.14 ml-inference:0.9.4 · tokenizer.so
  • 01 Binary-aware Found in a statically linked binary. Present in the fat JAR. Unlisted component — no CVE exists. pass pass pass checking
  • 02 Reachability-first Reached from the /auth handler. Vulnerable sink never reached. Reached via untrusted model input. pass fail pass checking
  • 03 Proof-backed PoC executes; kill-chain attached. No exploit path — not surfaced. Zero-day PoC + repro command. pass partial pass checking
  • 04 Pipeline-native Blocked the release in CI. Attestation signed; release allowed. Agent authority lowered via TIM. pass pass pass checking
Verdict Exploitable Not reachable Zero-day Verifying… Severity critical · proven suppressed · 0 noise high · proven —
The loop-back

An exploit becomes a trust signal.

Inside the platform, a newly reachable exploit doesn’t just open a ticket. It lowers the agent’s authority, blocks sensitive data, or triggers requalification — automatically, through TIM.

agent://api-gateway-deployer
Live trust state · from TIM
  • Production deploys ci → prod
  • Customer data access PII · PHI via PromptVault
  • Credential rotation vault write
  • Read-only telemetry metrics · logs
1,204 CVEs RepoAudit 3 exploitable

Ship what’s safe.
Prove what’s not.

Book An Assessment Build With ECRYPT