Know what your software is made of.
Two modules, each handing you records of provenance that anyone can check for themselves.
Dependency Canary
Know what you're pulling in
Every package update is read and reviewed before it reaches you. Import the results straight into your project.
Browse the audit feedAttestable Builds
Prove where a release came from
Builds run sealed off from everyone, us included, and come back with a signed record of provenance anyone can check against the source it names.
Check a fileInvite-only while we are in early access — request access or write to hello@lightsquares.dev. More about our work at lightsquares.dev.