Attested AI audits for every dependency update.
Fast, verifiable AI audits of all dependencies establish a baseline security before any CVE is published.
Solving Software Supply Chain Security →
What We Build
The sheer amount of code changes in dependencies often require lengthy reviews or result in rubber-stamping. Dependency Canary lifts this burden by providing baseline AI audits on every release and diff of your third-party dependencies, flagging malicious changes, and making the audit process itself verifiable.
Every audit yields a one-time input–code–output attestation. These attestations form a graph that humans and AI agents can query via API. For example, a coding agent checking a package before adding it as a dependency.
In development — the verdict in your PR
Dependency Canary — audit passed
serde 1.0.210 → 1.0.211 · diff audited in a TEE · no malicious changes found
attestation sha256:9f2a…c41d — verify independently
…and importable with cargo-vet
[[audits.serde]]
who = "Light Squares <audits@lightsquares.dev>"
criteria = "safe-to-deploy"
delta = "1.0.210 -> 1.0.211"
notes = "TEE-attested AI audit. Attestation: app.lightsquares.dev/a/9f2a…"Illustrative preview. Dependency Canary is in development, and our first release will be a free, public set of attested audits for the most-used crates, published in cargo-vet format.
- A Verdict in Your PR
- The attested audit result lands directly in the dependency-update pull request and can gate CI. No new dashboard to check.
- cargo-vet Compatible
- Audits are published as a cargo-vet-compatible feed, so Rust teams can import them with the tooling they already use.
- Verify It Yourself
- Portable, signed audit artifacts backed by hardware attestations. Verify the TEE quote independently, with no need to trust our infrastructure.
- Audit-Graph API
- Query the attestation graph via API, built for security teams and for AI coding agents deciding whether to add a dependency.
- CRA / NIS2 Evidence
- Turn audits into the due-diligence evidence for third-party code that CRA and NIS2 require, before the obligations land in late 2027.
- Honest Benchmarks
- We will publish detection rates against known-malicious corpora, with honest false-negative and false-positive numbers, alongside our first public audit corpus.
What This Means For Your Team
AppSec / DevSecOps
- Stop rubber-stamping dependency updates: gate CI on attested audit verdicts instead.
- Add a judgment layer on top of your existing SCA tooling, not another scanner to migrate to.
Developer / Engineer
- Merge dependency PRs with an audit verdict attached. No context switch, no extra dashboard.
- Let your coding agents query the audit graph before pulling in a new package.
Compliance Manager
- Export attested audit trails as CRA / NIS2 due-diligence evidence for third-party code.
- Be ready before the main CRA obligations apply in late 2027.
CISO / Security Lead
- Portable, signed proof instead of a vendor's black-box risk score, verifiable by anyone, including your auditors.
- European and sovereignty-aligned: verify the hardware quote yourself instead of trusting a vendor's infrastructure claims.
Ready to Get Started?
Book a call with our founders or join our early access program to see how Light Squares can help secure your infrastructure.