Docs
Security and privacy
What cra sends, what it keeps, and how to tell us about a problem.
What cra sends #
Only plain downloads, the same for everyone:
| From | What | When |
|---|---|---|
data.shipward.dev | The snapshot index and the files for the ecosystems in your SBOM | cra scan, when the cached copy is older than the published one |
euvdservices.enisa.europa.eu | ENISA’s list of exploited vulnerabilities | At most every 20 hours |
epss.empiricalsecurity.com | FIRST’s EPSS scores | At most every 20 hours |
No package names, no SBOM, no findings and no decisions leave your machine. cra scan --offline sends nothing at
all. cra sbom, cra check sbom, cra licences and cra triage set work offline.
What cra keeps #
The snapshot and the two feeds, in ~/.cache/shipward (your system’s cache folder). Everything else it writes is in
your repository, where you put it.
Reporting a vulnerability in Shipward #
E-mail daniel@sori-resitve.si. See also security.txt.