How ShipAttest works

No account needed. In a project folder, run:

npx @shipattest/cli scan .

The scan runs on your machine. It reads your lockfiles, sends package names and versions to OSV.dev, and checks the results against the public lists of actively exploited vulnerabilities from CISA and ENISA. Your source code is not sent anywhere.

It reads npm, yarn, pnpm, pip, Poetry, uv, Pipenv, Go, Cargo, Composer, Bundler and NuGet lockfiles. For firmware, containers, Java or C/C++, create a CycloneDX or SPDX SBOM with a tool such as Syft and pass it with --sbom sbom.json.

Sign up (the Free plan covers one product), then go to Settings → API tokens and create a token. Store it as a CI secret named SHIPATTEST_TOKEN. A token is shown once, and we keep only a hash of it.

Add ShipAttest to the pipeline that builds your releases. Each upload stores a CycloneDX 1.6 SBOM for that version and checks it for known vulnerabilities.

name: ShipAttest
on:
  push:
    tags: ["v*"]
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: shipattest/action@v1
        with:
          product: smart-hub
          version: ${{ github.ref_name }}
          token: ${{ secrets.SHIPATTEST_TOKEN }}
          with-usage: true

include:
  - remote: "https://raw.githubusercontent.com/shipattest/action/main/gitlab/shipattest.gitlab-ci.yml"

shipattest:
  extends: .shipattest-upload
  variables:
    SHIPATTEST_PRODUCT: smart-hub
  rules:
    - if: $CI_COMMIT_TAG

export SHIPATTEST_TOKEN=sat_...
npx @shipattest/cli upload . --product smart-hub --version 2.4.0 --with-usage

--with-usage (with-usage: true in the Action) also sends short excerpts of the lines that import each direct dependency, so AI triage can judge whether the vulnerable code is reachable. Leave it out to send only the component list.

Every release you still support is re-checked several times a day against OSV.dev, CISA's Known Exploited Vulnerabilities catalogue and ENISA's EU Vulnerability Database. When a version reaches the end of its support period, mark it out of support and monitoring stops.

When a component you ship becomes actively exploited, owners and admins get an email straight away with the exact deadline. Under Article 14, the early warning to ENISA is due within 24 hours of becoming aware.

Each vulnerability gets a decision: under investigation, affected, not affected (with a VEX justification) or fixed. Decisions are recorded in the audit trail and exported as VEX documents.

On paid plans, AI triage reads the advisory and how your code imports the package, then suggests whether the product is affected; a person confirms. ShipAttest drafts the 24-hour early warning, the 72-hour notification and the final report from the facts you hold, with gaps clearly marked, ready to submit through ENISA's single reporting platform.

Business also drafts the Annex VII technical documentation, the EU declaration of conformity, user information, a coordinated vulnerability disclosure policy and a security.txt file, and exports the full audit trail as CSV.

No. Under the Cyber Resilience Act, the manufacturer affixes the CE mark to its own product after a conformity assessment. For most products that is a self-assessment. Important Class II and critical products, and Class I products that don't fully apply harmonised standards, need an EU notified body (or, for some critical products, a European cybersecurity certificate). ShipAttest is not a notified body and does not certify products.

What ShipAttest does is most of the work behind the CE mark:

• •Classification: which category your product falls into and which conformity assessment routes are open to you (every plan).
• •An SBOM for every release (every plan).
• •Vulnerability handling for the whole support period: monitoring, alerts, triage and VEX (Team and Business).
• •The deadline clock and drafts of the 24-hour, 72-hour and final reports to ENISA (Team and Business).
• •Drafts of the technical documentation, the EU declaration of conformity, user information and a vulnerability disclosure policy, plus an exportable audit trail (Business).

You stay responsible for the security of the product itself (such as secure defaults, access control and security updates), for completing and signing the declaration of conformity, and for affixing the CE mark. ShipAttest checks the third-party components you ship; it does not test your own code or device.

We work in writing, not on calls. CRA compliance is detailed and technical, and a written answer explains it better: we can be precise, point to the exact article of the regulation, and you get an answer you can forward to your team and keep for your records. Email dan@shipattest.com with any question, before or after you buy.

See also pricing and security.

ShipAttest helps you meet obligations under Regulation (EU) 2024/2847. It does not provide legal advice and does not certify products.