Attested AI audits for dependency updates.
Fast, verifiable AI audits of dependency updates: a baseline check against malicious changes, published within 24 hours, bridging the gap until a human can review. Rust crates first, more ecosystems to follow.
Solving Software Supply Chain Security →
What We Build
Each dependency update poses the same choice: spend expert hours reading the diff, or rubber-stamp it. Dependency Canary takes that work off your plate with baseline AI audits of the new releases and diffs of your third-party dependency updates, published within 24 hours of landing on the registry. Malicious changes get flagged while a human review would still be weeks or months away.
Every audit runs in hardware-attested compute, so the execution of the audit itself is verifiable. Without that, an audit feed is just a claim: a compromised or dishonest publisher could post verdicts nobody ever computed, or quietly cut corners on the audit behind them. The attestation rules that out by proving which audit code ran on which diff to produce each verdict. The resulting attestations form a graph that humans and AI agents can query via API, for example a coding agent checking a package before adding it as a dependency. Read more about the technology behind it.
In development: importable with cargo-vet
[[audits.serde]]
who = "Light Squares <audits@lightsquares.dev>"
criteria = "safe-to-deploy"
delta = "1.0.210 -> 1.0.211"
notes = "TEE-attested AI audit. Attestation: app.lightsquares.dev/a/9f2a…"Illustrative preview. Dependency Canary is in development, and our first release will be a free, public set of attested audits for the most-used crates, published in cargo-vet format.
The cargo-vet ecosystem today
cargo-vet is an open-source tool from Mozilla that records audits of Rust crates in a shareable format, so teams can import each other's work instead of re-reviewing everything. Audits are made against criteria: safe-to-run means the code can be built and run without harm, say on a developer machine or in CI; safe-to-deploy additionally means it is fit for production use facing untrusted input. We like the concept very much. The problem is volume: the ecosystem simply is not producing enough audits to keep up with releases. That is the gap our attested AI audits fill.
- Audits Within 24 Hours
- New releases are audited within 24 hours of publication, shrinking the window between an update landing and someone having looked at it.
- cargo-vet Compatible
- Audits are published as a cargo-vet-compatible feed, so Rust teams can import them with the tooling they already use.
- Verify It Yourself
- Portable, signed audit artifacts backed by hardware attestations. Verify the attestation report independently, with no need to trust our infrastructure.
- Audit-Graph API
- Query the attestation graph via API, built for security teams and for AI coding agents deciding whether to add a dependency.
- CRA / NIS2 Evidence
- Turn audits into the due-diligence evidence for third-party code that NIS2 asks for today and that the CRA will require from late 2027.
- A Baseline, Not a Replacement
- A dependable first check against malicious dependency updates. It catches suspicious changes early and bridges the time until a human can review.
What This Means For Your Team
AppSec / DevSecOps
- Stop rubber-stamping dependency updates: gate CI on attested audit verdicts instead.
- Add an audit layer complementary to your existing SCA tooling, not another scanner to migrate to.
Developer / Engineer
- Check the audit verdict for any update with the tooling you already use, before you merge.
- Let your coding agents query the audit graph before pulling in a new package.
CISO / Compliance
- Portable, signed proof instead of a black-box risk score, verifiable by anyone, including your auditors.
- Export attested audit trails as due-diligence evidence for NIS2 today, and be ready before the main CRA obligations apply in late 2027.
- European and sovereignty-aligned: verify the attestation report yourself instead of trusting a vendor's infrastructure claims.
Ready to Get Started?
Book a call with our founders to see how Light Squares can help secure your software supply chain.