Strazh

Find the risk, get a grounded fix, apply it locally: a desktop scanner that matches your declared dependencies against OSV and uses NVIDIA Nemotron on Nebius Token Factory for fixes.

Comment

Inspiration

Most of a modern codebase is code someone else wrote. Per the Verizon 2025 DBIR, 30% of breaches involved a third party. Sonatype has identified 700,000+ malicious open-source packages since 2019. (Sources listed below.) Developers don't need another wall of CVEs. They need to know which declared dependency is affected, where it is declared, and what to change.

What it does

Strazh is a desktop app (Tauri + React + Rust) for a local repository:

  • Reads the dependencies declared in manifests such as Cargo.toml, package.json, requirements.txt and pyproject.toml.
  • Matches each package and version against the live OSV.dev advisory database, with ecosystem-aware version comparison.
  • Shows a severity summary (Critical/High/Medium/Low/Unknown), search and filters, plus a manifest → package → advisory graph for each finding, along with the fixed version the advisory reports.
  • Generates remediation guidance with NVIDIA Nemotron on Nebius Token Factory. The guidance is grounded in the advisory evidence (id, summary, component, ecosystem, manifest path, fixed version).
  • Apply fix edits the declaring manifest locally, with Undo.

Demo: we scanned Nebius's own open-source Token Factory cookbook (github.com/nebius/token-factory-cookbook). Strazh found 547 declared dependencies and 1,078 findings, 31 of them Critical. One was [email protected], GHSA-77rh-m34w-rv36 (Eval Injection). Nemotron recommended version 2.3.24. Apply fix changed pyproject.toml from agno>=1.5.1 to 2.3.24, and Undo was available.

Honest scope: findings are declaration-based. They are not reachability or exploitability analysis, and the AI guidance is not a tested patch. Repository source code is never uploaded. Only name, ecosystem and version go to OSV, and only advisory metadata goes to Nebius, and only when you click Generate.

How we built it

  • Frontend: React 19 single-screen UI (src/StrazhApp.tsx), with a small dependency-free Markdown renderer for AI output (no raw HTML).
  • Shell: Tauri v2 (Windows installers: MSI and NSIS).
  • Scanning (Rust): supply_chain.rs walks the repo and parses manifests. commands.rs holds scan_code_graph and scan_with_osv.
  • OSV (Rust): osv_client.rs queries api.osv.dev/v1/query and picks out severity and the applicable fixed version. Versions are compared by ecosystem rules, never lexically.
  • AI (Rust): nebius_client.rs calls the Token Factory OpenAI-compatible endpoint (https://api.tokenfactory.nebius.com/v1). The default model is nvidia/Nemotron-3_5-Lightning, overridable with NEBIUS_MODEL. generate_nemotron_fix builds the prompt from advisory evidence.
  • Tests: Vitest + Testing Library on the frontend. On the backend, a Rust regression harness (osv_tests) covers fixed-version matching and credential-loader scoping, and a nebius_test connectivity check.

Challenges we ran into

  • Choosing the right fixed version: OSV ranges need ecosystem-aware comparison, and a lexical compare gives wrong answers.
  • Keeping AI output honest: no source code goes to the model, so the prompt says that outright and the guidance stays advisory-based.
  • Applying edits safely: auto-edit only runs on clean single matches or simple ranges. Anything ambiguous is left for a manual edit.
  • cargo test --lib fails to start on the Tauri/Windows library crate (STATUS_ENTRYPOINT_NOT_FOUND), so we built a standalone test binary.
  • Severity "Unknown" when OSV gives only a CVSS vector. We show it as Unknown and never treat it as safe.

Accomplishments that we're proud of

  • An end-to-end loop on a real repository (Nebius's own cookbook) in about a minute: scan, a grounded Nemotron fix, then a local manifest edit with Undo.
  • Clear, honest UX about what a finding does and does not prove.
  • Credentials stay local (%APPDATA%\com.strazh.app\.env). They are never bundled, and source code never leaves the machine.

What we learned

  • Grounding the LLM in structured advisory evidence gives short, actionable output. A fast Nemotron model is enough for this per-finding call.
  • Supply-chain tooling earns trust by stating its limits.

What's next for Strazh

  • Handle complex manifests and monorepos (workspaces, lockfiles, multiple matches) for Apply fix.
  • Resolve transitive dependencies through lockfiles, and analyze reachability.
  • Route calls by difficulty, as the track suggests: Nemotron 3 Ultra for harder reasoning, Nano/Super for routine calls.
  • Optionally run batch scans on Nebius Serverless Jobs, plus macOS/Linux builds.

Sources

Built With

Share this project:

Updates

Submission history