StayAwakeBot documentation

saw hunts supply-chain worms in repositories, lockfiles, installed packages and on the host. It runs offline, out of the box. It removes what it confirms, opens the fix as a pull request, hardens the host and gates the merge. The last line of every report is the verdict.

For developers who ship software — in any of the eight package ecosystems saw reads — and for the people who keep an organisation's repositories gated. The vector is the same whatever the stack: a dependency install, a build, or an editor or agent opening the folder.

Start here — Your first scan · Gate a repository

Do a task — scan local code · scan GitHub repositories · fix findings · remove a compromised dependency · gate CI · scan on clone · audit a machine · harden this machine · harden a repository

Look it up — CLI reference · configuration · advisory database

What the tool promises — trust model · verdicts · fail closed · safety envelope · credential hygiene

The package also ships an unrelated uptime monitor, stayawake-health-check — see configuration.

Which version you are reading

Each release keeps its own copy of these pages, and the version selector at the top switches between them. latest follows the current documentation.

Documented versions begin at 0.6.2. Earlier releases were published before this site existed, so there are no pages describing them — rather than reprinting today's documentation under an older number, which would describe behaviour those versions do not have. If you are running something earlier, saw --version and saw <command> -h describe the copy you actually have.