Skip to content

Open-source approval for defense software teams

A developer pastes a link. QuickChain checks the software and everything it pulls in, then gives your reviewer the few findings that need a person.

See how it works

What QuickChain does

Developers ask for software by pasting a package name or a link to a GitHub repository, a release download or a Hugging Face model. QuickChain checks it along with everything it installs, works out which known vulnerabilities its code actually calls, and gives your reviewer a recommendation with the reasons written out.

The reviewer’s decision is recorded with their name, the date and the reason. When an assessor asks how new software gets vetted, you already have the answer on file.

One request, from paste to decision

Here’s an example request as the reviewer sees it. The package is made up.

npmpdf-export-kit 2.1.0
Checking
Requester says

Priya, developer: “Needed for the PDF report export in planner-web.”

What gets installed
Findings
QuickChain's rating
Decision

Not sent yet

Example request

How a request works

  1. Ask

    A developer pastes a package name or a link and says what it’s for. There’s nothing to install and no ticket to write.

  2. Check

    QuickChain looks at the software and everything it pulls in. Each known vulnerability goes in one of three piles: needs a judgment, applies but rated lower, or not called by this software.

  3. Decide

    The reviewer approves it, approves it with conditions, rejects it or sends back a question, and writes down why. That reason goes into the decision packet your ISSM reads.

Decision packet

pdf-export-kit 2.1.0

Requested by Priya, developer
Decided by Dana (reviewer)
Approved for
Report export in planner-web
1
Conditions
Upgrade to 2.1.4 within 30 days
2
Accepted
9 findings rated lower (Medium and Low), in what it installs
3
Open
None
4
The 24 packages it installs are listed after this page, with versions and licenses.

The decision packet your ISSM reads

  1. 1Approved for says where the package may be used. Approval for one project doesn’t carry over to the rest.
  2. 2Conditions are what the approval depends on, like an upgrade by a set date. A review date can go with them.
  3. 3Accepted names each group of findings the reviewer chose to accept, so an assessor can see the call that was made.
  4. 4Open lists anything still unresolved. It isn’t dropped to make the page look clean.

What QuickChain checks

Known vulnerabilities
Matched across more than a dozen package systems, from npm and PyPI to Swift, R and C/C++.
Whether the code calls them
QuickChain traces the software’s own code to the vulnerable function. If it sets a finding aside, the evidence is shown. If it can’t tell, the finding stays open for a person.
Malicious-package reports
A package with a malicious-package report comes back Blocked.
What it installs and runs
Every package it pulls in, how deep each one sits, and any script that would run at install.
Secrets and network behavior
Keys left in the code, telemetry, update checks and anything that downloads and runs code, so you know whether it will work offline.
Code weaknesses and configuration
Weak spots in the software’s own code, and a review of the deployment and container files it ships with.
Licenses
For the software and every package it brings in, checked against the licenses your workspace allows.
Origin and integrity
Release signatures where they exist, and a SHA-256 manifest of the files that were checked, for carrying them onto a closed network.
Installers and models
What’s inside an installer, read without running it. For a Hugging Face model, which weight files could run code when they load.
Reputation and maintenance
Who maintains it, how recently it was released, and whether it has been deprecated or abandoned.

What runs when: repository links, release downloads, installers and models get every check that applies. A package requested by name gets the vulnerability, install, license and maintenance checks. Every report lists what ran and what didn’t.

Public software only: a name that matches your internal package names is refused and never looked up publicly.

No AI on your code: the checks are rule-based. No source code is sent to an AI model.

Start with a 90-day pilot

$3,000

Put your team’s real requests through QuickChain for 90 days. If you stay on, the full pilot fee comes off your first year.

See full pricing

Bring a package your team is waiting on

Iron Ridge CyberQuickChain is built by Iron Ridge Cyber.About us