2026 年每日通報的 CVE 數量比前一年多 131%。

SaaS 與雲端服務的 CRA 法規遵循

在不拖慢版本發布的前提下，掌握服務每一次建置所取用的內容

為雲端交付而設計

CRACI 在位於歐洲基礎設施上的代管執行器中執行您的 GitHub Actions 建置，並記錄每次建置取用的所有相依套件。針對您建置並交付的服務，CRACI 可自動化 CRA 流程所需的供應鏈可視性與佐證資料中相當大的一部分。

GitHub Actions jobs on CRACI runners A GitHub Actions workflow sets runs-on to craci. Each job runs in its own isolated virtual machine on a CRACI runner, on Linux x86-64 or ARM64, hosted in Europe, and the run still appears in GitHub. .github/workflows/release.yml jobs: build: runs-on: craci was: ubuntu-latest CRACI runners Hosted in Europe Job VM build Linux x86-64 Job VM test Linux ARM64 Job VM publish Linux x86-64 One isolated virtual machine per job, 1 to 32 vCPU Runs still appear in GitHub About 2x GitHub-hosted speed

持續部署保護

CRACI 會在每次建置時記錄附有完整性狀態的 SBOM，強制執行在每個作業開始前即完成驗證的對外連線（egress）政策，並透過 API 回傳 SBOM、網路追蹤記錄與來源證明（provenance）。設定只需 runs-on: craci，因此您的版本發布節奏維持不變。

An SBOM recorded during the build Packages from npm, PyPI, Cargo, Go, OCI registries and the CI cache pass through a package-aware proxy on the CRACI runner. The job's SBOM lists what was fetched, states its completeness and exports as CycloneDX or SPDX. Package sources npm PyPI Cargo · Go OCI registries CI cache restore Package- aware proxy on the runner Job SBOM express 5.2.1 requests 2.32.3 serde 1.0.219 + transitive deps Declared license on every component Complete Completeness states per job and cache: Complete, Complete with connections, Incomplete, Unavailable, Not recorded CycloneDX · SPDX

多產品管理

檢測結果會跨建置與儲存庫彙整，資產清冊檢視則精確顯示哪些軟體版本部署到哪些產品。SBOM 可匯出為 CycloneDX 或 SPDX 格式，並包含漏洞資訊。

One view across builds and repositories Findings from every build are aggregated across repositories, with organization views on the default branch. The inventory view shows which software versions are deployed to which products. Default branch builds api-service web-app firmware billing Organization view Findings aggregated across builds and repositories 4 repositories, one list of findings Inventory: deployed versions Product Version Web app v4.12.0 Mobile API v2.3.1 Gateway firmware v1.8.4

API 安全與監控

掌握您的 API 伺服器正在執行什麼。CRACI API 會回傳每次建置的 CycloneDX SBOM、網路追蹤記錄與來源證明，受監控的 SBOM 也會在新漏洞公開時重新評估。

Provenance data from every build Every job on CRACI records the packages it fetched and its network trace. The public REST API returns the job's SBOMs, network trace and provenance. Build release job on CRACI Recorded packages fetched network trace Provenance build data, via the API Ask the API about any job Job → SBOM, trace, provenance Returned by the API Job Packages CycloneDX SBOM Network trace Recorded on every CRACI job, no extra step

放心擴展您的 SaaS

預約示範，了解如何以 CRACI 保護您的雲端服務

預約示範