2026 年每日通報的 CVE 數量比前一年多 131%。

產品經理的 CRA 法規遵循

掌握每個版本發布的內容，帶著 CRA 流程所需的佐證資料進軍歐洲市場

以法規遵循為先的產品策略

在 CRACI 上的每次建置，都會針對實際取用的內容產生 SBOM，並附上完整性狀態。因此，CRA 流程所需的佐證資料會隨著出貨逐步累積，而不是在上市前手忙腳亂地補齊。CRACI 會自動處理 CRA 流程所需的供應鏈可視性與佐證資料中相當大的一部分；產品決策仍由您掌握。

An SBOM recorded during the build Packages from npm, PyPI, Cargo, Go, OCI registries and the CI cache pass through a package-aware proxy on the CRACI runner. The job's SBOM lists what was fetched, states its completeness and exports as CycloneDX or SPDX. Package sources npm PyPI Cargo · Go OCI registries CI cache restore Package- aware proxy on the runner Job SBOM express 5.2.1 requests 2.32.3 serde 1.0.219 + transitive deps Declared license on every component Complete Completeness states per job and cache: Complete, Complete with connections, Incomplete, Unavailable, Not recorded CycloneDX · SPDX

最佳化上市時間

設定只需要修改一行：安裝 GitHub App，並設定 runs-on: craci。執行結果仍會顯示在 GitHub 中，因此開發人員可沿用原本的工作流程，而每次建置都會記錄 SBOM、在對外連線（egress）政策下執行，並記錄來源證明資料。發布前不需要執行任何額外步驟。

Connect CRACI with a GitHub App The CRACI GitHub App is installed on all or selected repositories of a GitHub organization. CRACI can then run the jobs of the repositories you chose. Install the CRACI GitHub App Repository access for your organization All repositories Only selected repositories api-service web-app firmware sandbox CRACI runs the jobs of the repositories you chose You keep control of which repositories those are Runs, logs and checks stay in GitHub

客戶信任與透明度

當客戶詢問您的產品包含哪些內容時，您可以將 SBOM 匯出為 CycloneDX 或 SPDX 格式，其中包含遞移相依套件、宣告的授權，以及在其元件中找到的漏洞。API 會回傳 SBOM、網路追蹤記錄與來源證明。

SBOMs and build records for each reader SBOMs export as CycloneDX or SPDX, including transitive dependencies and the vulnerabilities found in their components, and the API returns SBOMs, network traces and provenance, so the same record serves customers, auditors and your own tooling. One record SBOMs Vulnerability records Provenance Network traces Exported from CRACI or through the API CycloneDX SBOM SPDX SBOM API: network traces API: provenance Same evidence, every audience No manual assembly between the build and the SBOM SBOMs carry transitive dependencies and vulnerabilities

市場准入與拓展

依據 Cyber Resilience Act（CRA）在歐盟銷售產品，意味著必須在整個支援期間處理漏洞，並通報遭積極利用的漏洞。CRACI 會持續重新評估您已出貨內容的 SBOM，為您準備 CRA 通報的內容供您提交，並為您的文件提供技術佐證資料。符合性評鑑與 CE 標示仍屬於您的流程。

CRA notifications, prepared for you When a vulnerability is actively exploited, the CRA sets deadlines: an early warning within 24 hours, a notification within 72 hours and a final report 14 days after a fix is available. CRACI prepares their content; a person at the manufacturer submits them through the CRA Single Reporting Platform to the CSIRT and ENISA. Actively exploited vulnerability found Aware 24 hours Early warning 72 hours Notification Fix + 14 days Final report CRACI prepares the notification content You submit it through the Single Reporting Platform to the CSIRT and ENISA and shows which products and releases are affected What stays with you The reporting obligation itself Informing affected users Severe incidents: final report within one month

更快出貨合規的產品

預約示範，了解如何透過 CRACI 加速產品開發

預約示範