Open source CLI · read-only

When something you depend on goes bad, br tells you everywhere it is.

Repos, CI runs and the secrets they held, caches, container images (deleted layers included) and laptops. Then who owns each place and how to clean up. It runs on your machine and only reads.

try it · node 18+

$ npx -y @jondot/blastradius demo

Read the docs GitHub

No token yet? br demo runs a made-up incident on a sample org built into the binary.

What you see

Each falling bug is a real advisory. br checks it on the way down, or shows where it landed in your org. Click the sky to check one yourself, then scroll down through the layers br reads.

Loading advisories from GitHub…

One command

Where it is, who owns it, what's next.

Every place, now or in the window. Repos, CI runs, caches, artifacts, images and machines that hold the bad version, or held it.
The owner of each. From CODEOWNERS and teams, so the right people get one message each.
What it could not check. A clean answer with gaps is "clear with gaps", never plain clear.

Terminal output of br hunt on a sample org: 7 repos, 8 CI runs, 2 images and 9 secrets to rotate, a list of places with owners, the sources not checked, and the next commands to run.

Not just packages

The week of October 2026, four commands.

Four incidents landed in a few days, and none was a bad package version. Each one is a single br hunt. Screenshots are real runs against a sample org, with made-up names and certificates.

br output listing PHP runtimes below the fixed release of their branch, with owners.

Critical

PHP2Shell

Remote code execution in PHP itself. Every PHP below the fixed release of its line, in version files, Dockerfiles, workflows, images and machines.

shell

$ br hunt runtime:php@fixed:8.5.12,8.4.27,8.3.36,8.2.35

br output listing Node.js runtimes in images and CI that are below the October release.

High

Node.js October release

Images, runners and laptops on a Node line below the fix, and end-of-life lines that got none.

shell

$ br hunt runtime:node@fixed:22.23.4,24.22.1,26.12.1

br output listing the trust stores that still hold the distrusted emSign root certificate.

High

A distrusted root CA

OS bundles in image layers, certifi, Java cacerts and PEM files in repos that still trust it.

shell

$ br hunt "cert:subject:emSign ECC Root CA - G3"

br output listing secrets matching a name, each marked rotated or not rotated since the breach.

Critical

A platform breach

Where each matching secret is stored, what read it, and whether it was rotated since. From names and dates only; br never reads a secret value.

shell

$ br hunt 'secret:RAILWAY_*' --since DATE

Where it looks

One local index of your org.

Built once from your GitHub org, your container registries and the machines you point it at. Laptops that can't be reached scan themselves and send a sealed file.

ReposLockfiles and manifests with their history, and CODEOWNERS

CIWorkflows, Actions runs and the secrets they could read, runners

ImagesLayers and files by hash, including files a later layer deleted

LaptopsLocal scans, sealed and imported

Caches and artifactsActions caches, build artifacts and release assets

SecretsWhere stored, who read them, rotated or not

Trust storesCA certificates in images, environments and hosts

Published today

Check against the newest advisories.

The same bugs that fall at the top of this page: the most severe of the latest reviewed advisories on GitHub. Each row is one command against your index.

Advisory	Package	Summary	Command
Loading…

Where br fits

It complements your scanners.

Tool	Question it answers	Output
Dependabot, osv-scanner, trivy	Is a known-vulnerable package in this code or image now?	Alerts, PRs, scan reports
Socket	Does this package behave badly, before I install it?	A verdict on a package
GitHub secret scanning	Has a secret been committed?	Alerts
br	A thing is known to be bad. Where did it go, what could it reach, is it really gone?	Places, CI runs and secret names, owners, a sealed record

Trust

It only reads, and says what it missed.

Every GitHub call is a GET or a HEAD. A read-only token is enough.
A hunt reads only the local index, unless you pass --now, --live or --path.
Every answer says how old the index is and which sources it could not check.
Evidence is sealed with a sha256 manifest and can be signed with your SSH key.

Exit codes

0	Clear
10	Found
3	Clear with gaps, under `--strict`
5	No index, or a stale one
11	Nothing found, under `--fail-if none`
4 2 1	Auth problem, usage error, failure

Install

One line, then one question.

shell

$ npm i -g @jondot/blastradius               # Node 18+; or the installer below
$ br demo                                    # try it on a sample org, no token
$ br init --org YOUR_ORG                     # once, with a read-only token
$ br hunt --advisory GHSA-xxxx-xxxx-xxxx

Without Node, the installer checks the sha256 and puts br in ~/.local/bin:

shell

$ curl -fsSL https://raw.githubusercontent.com/jondot/blastradius/main/install.sh | sh

Linux, macOS and Windows builds are on the releases page.

Read the docs Playbooks by role