Security that follows your software after release
Track vulnerabilities in shipped environments, from the first SBOM to the next update.
Interactive demo. 3 invaders left. Click, tap, or use Tab and Enter.
Built for the life of your product
Meet Atlas Robotics
Atlas Robotics is a fictional company shipping vision software for inspection robots. This example shows how a real CVE could affect its workflow and a release already running at customer sites.
Meet Stacy
Security lead
She investigates findings, coordinates disclosure, and keeps customers informed.
Meet Ryan
Vision engineer
He builds the application, validates fixes, and ships updates.
Stacy and Ryan use prefix.dev’s tools to ship a release and respond when a vulnerability affects it.
Ryan
Vision engineer
Ryan ships Inspection Robot 4.2
Ryan ships Inspection Robot 4.2
Atlas Robotics builds its vision application with Pixi and distributes it through prefix.dev. Release 4.2 includes Pillow 10.2.0, recorded alongside its other dependencies in SBOM revision 7.
Release record
Inspection Robot release 4.2
SBOM revision 7
CycloneDX / SPDX with versions, builds, hashes
A Pillow advisory is published
Pillow 10.2.0 is affected.
Stacy
Security lead
Stacy receives a vulnerability alert
Stacy receives a vulnerability alert
Basilisk identifies a Pillow advisory. An automatic notification tells the vision team that release 4.2 contains the affected version and that Pillow 12.3.0 includes a fix.
New vulnerability for the vision team
Pillow 10.2.0
High (CVSS 4.0: 8.7)
A crafted JPEG2000 image can exhaust memory during decoding.
- Affects
- Inspection Robot 4.2
- Upstream fix
- Pillow 12.3.0
Assigned to StacyStacy
Security lead
Stacy opens a disclosure case
Stacy opens a disclosure case
Stacy drafts a customer advisory with release 4.2 attached and impact marked “under investigation.” She assigns Ryan as reviewer and checks applicable reporting obligations. A review reminder is scheduled for Ryan.
DISCLOSURE CASE
Unpublished draftInspection Robot 4.2
- Impact
- Under investigation
- Owner
- Stacy, security lead
- Evidence
- Release 4.2, SBOM revision 7
- Reviewer
- Ryan, vision engineer
- Publication
- Requires approval
Review due today
Reminder scheduled for Ryan
Ryan
Vision engineer
Ryan validates the fix for the vision pipeline
Ryan validates the fix for the vision pipeline
Ryan confirms that uploaded images reach the affected decoder. He updates Pillow, validates the pipeline, and ships 4.2.1 with SBOM revision 8. Stacy adds the fix to the advisory and sends it for approval.
Release 4.2
pillow 10.2.0
CVE-2026-59204
SBOM revision 7
Release 4.2.1
pillow 12.3.0
Resolved in 4.2.1
SBOM revision 8
“Are our robots affected?”
“We’re still running release 4.2.”
Customer
Stacy
Security lead
Stacy answers a customer still running 4.2
Stacy answers a customer still running 4.2
Stacy retrieves the original SBOM, Ryan’s impact assessment, and the reviewed advisory. She can explain the risk and point the customer to 4.2.1. Both supported releases remain monitored, with new findings sent to the vision team.
Inspection Robot release history
4.2
Supported and monitoredPillow 10.2.0, SBOM revision 7
Affected. Update to 4.2.1
Assessment and advisory retained
4.2.1
Supported and monitoredPillow 12.3.0, SBOM revision 8
Resolved in 4.2.1
Validated update recorded
The vision team receives new findings for affected releases.
From development environment to supported release
| Capability | Ubuntu + apt | Docker + scanner | Prefix.devSupply Chain SecurityBuilt on RoboStack + Pixi |
|---|---|---|---|
| Environments | |||
| Install ROS packages | Included | Included | |
Help shape whatwe build next.
We’re looking for early-access partners maintaining software across multiple releases. Tell us how you track vulnerabilities and where the process gets difficult.
