How it works
A supply-chain graph, not a stale list.
actik treats your software supply chain as what it actually is: a graph. Every scan, blast radius, time travel, and worm simulation is a traversal over that graph, powered by HydraDB.
Step 1 · Scan
Point it at a public repository.
actik reads the lockfiles directly from GitHub or GitLab. No cloning, no API token, no setup.
Step 2 · The graph
Every dependency is an edge.
Advisories affect package versions, versions depend on each other, and applications resolve them. actik stores all of this in HydraDB and traverses it, not a flat database.
Step 3 · Keep watching
Know the moment something goes live.
Poll OSV for every scanned version and get first-seen alerts, each with its exposure path, the instant a dependency is flagged.
Step 4 · Propagation
Watch a compromise spread in real time.
Simulate a package being compromised at a moment in time and see exactly which services get exposed, and when, as a per-hop graph traversal.
Questions the graph answers
The tracking questions.
What is the complete blast radius?
Given a compromised package version, actik walks the reverse dependency closure in HydraDB and tells you every service that resolves it, directly or transitively, with the exact repository to lockfile to package chain.
What are the transitive exposure paths?
The graph stores the precise path from advisory to package to the repository that resolved it, not just a package list. Every finding is cross-checked against Google OSV, so you can verify the affected range yourself.
What was exposed while the advisory was live?
Time travel replays the graph as-of any date and compares each scan timestamp against the advisory's published and modified window, showing which applications resolved the bad version at the moment it mattered.
How fast does a compromise spread?
The worm-speed simulation walks the reverse dependency closure and computes exactly when each service is exposed based on its distance from the compromised package. That is the '09:00 compromised, 09:06 exposed' scenario.
What is the fewest change that clears it?
actik returns a minimal-fix set: the smallest set of package upgrades that clears the whole blast radius, each verified by re-traversing HydraDB to confirm the target resolves to zero advisories.
FAQ