Windows app · in development
Know what is inside your software, and be ready to report.
CRA-Shield Local builds the software bill of materials (SBOM) for your project, checks it against known vulnerabilities without sending anything out, and pre-fills the EU Cyber Resilience Act incident reports.
Not for sale yet. We are testing it on many kinds of real files and measuring what it does on an ordinary PC. The version, the price and the measured results will be published here when it has passed.
Who it is for
Makers of software and connected products in the EU who must know what their product contains and be able to report a serious vulnerability quickly.
What it does
CRA-Shield Local in short
Your project, six formats
Reads requirements.txt, pyproject.toml, package.json, package-lock.json, Cargo.lock and go.mod from a project folder.
CycloneDX 1.6
Writes the bill of materials in the format the EU asks for, with a package URL and a hash for every component and the relationships between them.
Known vulnerabilities, offline
Compares the components with a local advisory list. You can import a current advisory file so nothing is looked up online. Checks the SBOM against the German BSI TR-03183-2 field requirements.
Article 14 drafts
Drafts the 24-hour, 72-hour and 14-day notifications for the ENISA reporting platform, so the clock does not start from a blank page.
The Cyber Resilience Act's reporting obligations for actively exploited vulnerabilities apply from 11 September 2026.
Point it at a project folder, fill in the product details, press build, and keep the SBOM and the report drafts with your records. The same input gives the same result, which makes the output usable as evidence.
Your data
It stays on your computer.
Your dependency list shows your suppliers and your architecture, so it stays on your computer. The program opens no network connection.
Honest limits
What CRA-Shield Local does not do
- The built-in advisory list is a small starter snapshot. Import a current advisory file for real use.
- It does not watch for new vulnerabilities continuously.
- VEX statements and CVSS scores are not produced yet.
- It prepares evidence and drafts. It is not a CE-marking tool and not legal advice.
Conversation
Questions, ideas, experience with similar tools
Anyone can read. To join in, sign in with Google or a free account. Your first comment is checked by a person; later ones appear at once.