- 8656 W. Hwy 71, Bldg F200 Austin, Texas 78735
Works alongside Dependabot, Snyk, and your existing tools. Adds maintainer health, license compliance, and supply chain checks they don’t cover.
Dependabot updates your deps. Snyk finds vulnerabilities. But who catches the abandoned package with one maintainer? The typosquatted name? The install script that runs on npm install?
Risk Guard adds the risk signals your stack is missing – without replacing what already works.
Bus factor scoring, abandonment detection, single-author flags. Know when a critical dependency is one person away from being unmaintained.
Typosquatting detection, source/registry mismatch, install script analysis. Catch attacks that don’t show up in CVE databases.
20+ checks. Copyleft, commercial restrictions, missing declarations. Don’t let a license violation kill your deal.
Package/source verification, registry existence, name impersonation. Verify what you’re actually installing.
Findings in GitHub Check annotations. No new dashboards to check.
.risk-guard.yml in your repo. Version-controlled. Reviewable.
Complements Dependabot, Snyk, Renovate. Doesn’t replace them.