Evidence your team can inspect, defend, and gate on.
QuickChain connects SBOM generation, advisory matching, static reachability, and exportable review packages. The output is built for the people who have to answer for it: where a finding came from, whether there is a runtime path, what fix data exists, and how it affects the release.
name: QuickChain
on:
pull_request:
push:
branches: [main]
permissions:
contents: read
jobs:
quickchain:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: IronRidgeCyber/QuickChainAction@v1
with:
api-key: ${{ secrets.QUICKCHAIN_API_KEY }}
project-id: ${{ vars.QUICKCHAIN_PROJECT_ID }}
fail-on: critical
fail-on-reachable-only: true
wait: true
- uses: actions/upload-artifact@v4
if: always()
with:
name: quickchain-results
path: QuickChainResults/One finding is work. One is documented.
QuickChain works out which vulnerable functions your application can actually reach at runtime, and gives every finding a defensible disposition. The two below came from the same scan.
A runtime call path runs from the route to the vulnerable function. QuickChain keeps this finding in the queue with the evidence attached.
no call path from any entry point.
justification: vulnerable_code_not_in_execute_path
The suppression is deterministic and carries its own justification, so an assessor can see why the finding was set aside.
Dependency manifests
The transitive tree is built from the manifests and lockfiles in the repo.
Language coverage
Runtime reachability analysis is deepest on JavaScript, TypeScript, and Python. Inventory coverage extends across the rest.
Standards in, standards out
The same scan produces machine-readable evidence in the formats your reviewers already parse.
{
"@context": "https://openvex.dev/ns/v0.2.0",
"author": "QuickChain",
"statements": [
{
"vulnerability": { "name": "CVE-2023-46233" },
"products": [
{ "@id": "pkg:npm/crypto-js@3.3.0" }
],
"status": "not_affected",
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "No call path from an HTTP entry point reaches the affected function."
}
]
}- CycloneDX JSON SBOM
- SPDX SBOM
- OpenVEX JSON
- OSCAL assessment results
- POA&M workbook (XLSX)
- Risk assessment memo (DOCX)
- CSV extracts
- ZIP package with manifest and SHA-256 hashes
