| What it does | Simple package management for private and public packages
| Evidence collection for security fixes in your GitHub repo
|
|---|
| Stage | Not given
| Not given
|
|---|
| Founded | Not given
| Not given
|
|---|
| Based in | Not given
| DE
|
|---|
| Pricing model | Not given
| Freemium
|
|---|
| Pricing | Cloud Free: $0 (10GB storage, 100 published packages); Cloud Standard: $79/month (80GB storage, 500 published packages); Cloud Pro: $499/month (600GB storage, 4000 published packages); Cloud Enterprise: Custom pricing. Self-hosted Personal: Free (non-commercial use); Self-hosted Standard: $1999/year
| Free GitHub Action (MIT license). fixdossier Pro: €69 one-time founding licence (tax included via Dodo Payments, no recurring annual fee) for first 50 GitHub Organizations, includes 1 GitHub organization, up to 3 repositories/products, up to 5 reviewers, up to 24 Final Evidence Packs per year, 60 Dr
|
|---|
| Key features | - Support for multiple package types including Docker, npm, PyPI, Maven, NuGet, Go, Helm, RPM, Debian, Cargo, Conan, Composer, RubyGems
- Smart package search across names, metadata, and READMEs
- Proxy caching for faster and more reliable CI pipelines
- SSO and LDAP integration for access control
- Comprehensive audit logs for compliance
- Cloud and self-hosted deployment options
- Built-in README viewer and documentation
| - Collects security-fix evidence from releases, tags, GitHub security advisories, Dependabot/Renovate PRs, and commits
- Generates dated fix record with transparent mapping methods
- Creates machine-readable JSON output (fixdossier/v1 schema)
- Generates support policy with security support dates per release
- Pro: OIDC CI ingestion with zero long-lived repository secrets
- Pro: Human sign-off with append-only review ledger and reviewer attribution
- Pro: Export Ed25519-signed Evidence Packs as PDF and ZIP
- Runs on every release and weekly with default GITHUB_TOKEN
- Notes permission gaps instead of failing the run
|
|---|
| What makes it different | - Smart search across package names, versions, metadata, and READMEs within RepoFlow
- Built-in vulnerability scanning with CVE detection and remediation context
- Proxy caching to keep builds resilient during outages and rate limits
- Automatic migration from Artifactory, Nexus, Verdaccio, and GitLab Package Registry
| - MIT-licensed free tool with transparent mapping methods showing how each fix was identified
- Generates support periods and compliance-ready evidence for EU Product Liability and Cyber Resilience regulations
- Pro: Ed25519-signed, verifiable Evidence Packs with full audit trails for customer questionnaires and archives
- Reads advisory patched_versions ranges for precise version mapping without keyword guessing
|
|---|
| Community votes | 0 | 0 |
|---|
| DR (Domain Rating by Ahrefs) | 48 ▼ −1 (down) since last check | Not checked yet ● no change since last check |
|---|
| Trust Flow (Majestic) | 26 | 0 |
|---|
| Citation Flow (Majestic) | 35 | 12 |
|---|
| Referring domains (Majestic) | 317 | 2 |
|---|
RepoFlow