Built in Canada first Signed evidence Cited context Stewarded OSS

Build Lightning-Fast with AI. Verify Security in Public.

Upload the dependency files your AI workflow already creates. Publicus checks the stack against signed registry decisions and fresh public evidence, then shows what blocks release before any synthesis layer gets involved.

Scan dependency file Check one package Browse registry evidence

Start with a scan, drill into public evidence, and use Ask only when you need a scoped recommendation on top of what was inspected.

Stack scan

Scan the files your AI workflow produced.

Open dedicated scan page

Results appear below after upload: blockers first, then package-level verdicts, freshness, source links, and evidence-pack downloads. The dedicated scan page uses the same frontend code.

No file yet?

Check one package directly.

Use this for a package your AI tool suggested before you add it to a project.

Package lookup uses the same evidence path as uploads.
No scan open. Upload a file, check one package, or open the dedicated scan workspace. Full package rows stay hidden until you explicitly inspect a scan.
Start here

One normal journey: scan, fix, verify.

A developer should not need to understand the whole trust substrate before getting a useful answer.

Upload my stack Use package.json, lockfiles, requirements files, TOML manifests, Go/Cargo files, SBOMs, or plain package lists. Check one package Paste an AI-suggested package and version before it enters a project. See active exploit pressure Start with Publicus AI-stack intersections against known exploited vulnerabilities. Understand the result Read status, freshness, source evidence, and review limits in plain language.
Why this is different

Models create capability. Publicus creates reusable proof.

Frontier cyber models, open model releases, package scanners, and SBOM tools all matter. Publicus is the public layer around them: current package evidence, signed registry truth, Canada-readiness mapping, review pressure, and exportable proof that a reviewer can inspect without trusting one opaque answer.

For AI builders Upload the files your coding agent produced and see what blocks release before shipping. For Canada review Use readiness evidence and standards crosswalks without claiming certification. For model-agnostic trust Understand why Publicus remains useful when advanced cyber models become broadly available. For open-source stewardship Open contribution comes through trusted review paths before any public claim changes.
Currentness

Fresh evidence checks, not one vague “live” claim.

A package scan can run fresh upstream checks on demand. The curated registry, source sync, projection, and movement feed publish their own clocks.

Loading
—
Package evidence checked
—
Loading
—
Projection refreshed
—
Loading
—
Persisted source sync
—
Loading
—
Latest movement published
—

Currentness lanes load from the deployed projection. Object-specific package scans run fresh upstream checks on demand.

Momentum

What changed since the last evidence check?

Keep the overview focused. Recent movement appears here; deeper source coverage lives in the source contract.

—
Movement events shown
—
Exploited-risk deltas
—
Active evidence sources
—
Canada evidence sources
—
Source-check failures
Evidence coverage

Source coverage at a glance

Source coverage is grouped by usefulness so the overview shows what is active now without turning into a source catalogue.

Review source contract See Canada mapping
Open-source trust

The public corpus stays open. Private help lives at the edge.

The registry, source contracts, scan schema, CLI, APIs, evidence packs, and governance model are the public good. Hosted support can help teams with private packages, release readiness, and procurement workflows without closing the trust substrate.

Propose a source See what is active, blocked, or waiting for an adapter before adding another portal. Dispute evidence Challenge a public claim with primary-source proof and a reviewable change. Become a trusted reviewer Help expand the open corpus without letting untrusted edits become public truth. Need private release readiness? Use hosted support for private overlays, SLAs, and Canada procurement evidence while the core remains open.