CRA File: your Cyber Resilience Act technical file
Scan a repository. Get a readiness score, known vulnerabilities and an SBOM free, then the technical file, declaration of conformity and Article 14 templates drafted from your code.
Scan your product
Paste a public GitHub repository, or upload a .zip of your source code.
Or upload:
Why now
The EU Cyber Resilience Act (Regulation (EU) 2024/2847) covers software and connected products sold in the EU. Its reporting duties under Article 14 have applied since September 11, 2026: an actively exploited vulnerability needs an early warning within 24 hours. From December 11, 2027 every product needs technical documentation, a software bill of materials, vulnerability handling and an EU declaration of conformity before it can carry the CE mark.
What you get
- Free, every scan: a readiness score against the Annex I checklist, known vulnerabilities in your dependencies (checked against OSV.dev), and a CycloneDX SBOM to download.
- With a plan: the technical file draft (Annex VII structure, filled from your repository), the EU declaration of conformity draft (Annex V), SECURITY.md, security.txt, and the three Article 14 reporting templates.
- Weekly monitoring: each product on your plan is rescanned every week, and you get an email when a new advisory hits one of its components.
Lockfiles and manifests are read as text: npm, pnpm, yarn, pip, Poetry, Pipenv, Go, Cargo, Composer, Bundler, NuGet and Maven. Nothing in your repository is run.
Prices
Cancel any time. Your latest payment is refunded automatically within 10 days if the plan was not used since (refund policy). Terms · Privacy.