Security model & limits

What Scrutyn does to lower your supply-chain risk, and the limits you should plan around.

What Scrutyn does

• Holds new versions in the Lazaretto for a window you set.
• Screens every package with Lens before it is served, and keeps re-evaluating stored versions.
• Serves installs from Depot’s own stored copy, checked against its hash, under your account’s policy.
• Records every download and sends a recall when a version you downloaded is later found malicious.

Limits

No malware-free guarantee

No scanner catches everything. Lens lowers the chance that a malicious version reaches you; it can’t promise that none will.

Waiting doesn’t detect anything

The Lazaretto only buys time for scanners, feeds and maintainers to find a bad release. A version that is still bad after the window is caught only if something flags it.

Waiting delays fixes too

A new release that fixes a vulnerability waits like any other. Versions an advisory lists as the fix can clear sooner, and an admin can approve an audited exception for one version; both are logged.

Immutable isn’t allowed forever

Depot never swaps the bytes of a version it holds, but new evidence can still block that version from future delivery and trigger a recall.

Integrity is not safety

SHA-256 shows that the file we serve is the file we scanned and stored, byte for byte. It says nothing about whether its code is harmless.

Vulnerabilities are not malware

Lens looks for malicious packages. A known vulnerability doesn’t hold or block a version on its own; advisories only shorten the wait for the version that fixes one. Keep a vulnerability scanner for that job.

AI reviews only the unclear cases

When engines disagree or are unsure, AI review helps weigh the evidence. It doesn’t review every package, and on its own it never blocks a version permanently.

A pending scan isn’t a verdict

If scanning is unavailable, versions without a verdict aren’t served until they are scanned. That says nothing about the package being malicious.

A recall can’t undo an install

It names the devices that downloaded a version later found malicious and tells you what to do. It can’t delete files on those machines or undo code that already ran.

Only what reaches Scrutyn is covered

Protection applies to requests sent to Scrutyn with a device token. Direct registry URLs, git dependencies, downloaded scripts and other ecosystems aren’t covered. Agent skills and hooks guide an agent; for strict enforcement, add managed configuration or network rules it can’t change.

Infrastructure providers

Read more

The technical documentation covers the engines, their licences and the full threat model; the legal terms cover liability. See also How it works.