Strazh v1.0.0 (Hackathon)

Strazh is an autonomous supply-chain security scanner for local repositories: it reads your declared dependencies, matches them against the live OSV advisory database, shows the manifest -> package -> advisory relationship, generates advisory-grounded remediation with an NVIDIA Nemotron model on Nebius Token Factory, and can apply a local version bump to the declaring manifest (with Undo).

Demo video: https://www.youtube.com/watch?v=CFnPRriDur4

Downloads (Windows x64)

Artifact	SHA-256
Strazh_1.0.0_x64_en-US.msi	4F037201186FAB09295CC3D5A6B9661A5E9D117AC6E63F67786024E775BD38E6
Strazh_1.0.0_x64-setup.exe	E32B68657E9DD033991C49B071A2A2A8B8A482E016473632E318BD5906E42530

Verify a download before running it:

Get-FileHash .\Strazh_1.0.0_x64_en-US.msi -Algorithm SHA256

Notes

• Repository scanning (OSV) needs network access but no key. AI remediation needs a NEBIUS_API_KEY in %APPDATA%\com.strazh.app\.env (see README).
• Nemotron receives advisory metadata only -- never your source code -- and only when you click Generate.
• Apply fix edits one dependency version in one manifest, locally, with Undo. No commits, no PRs, no remote writes.
• WebView2 runtime is required (preinstalled on current Windows 10/11; the NSIS installer offers to fetch it if missing).
• Tauri bundles are not byte-for-byte reproducible, so a local rebuild's hashes will differ from those above.