Crash Override

Crash Override is a software supply chain SCA and provenance platform that runs inside the build rather than scanning it from outside.

Crash Override embeds a signed mark into every artifact recording what went into it, then tracks that artifact through to production.

The company positions itself deliberately: “a developer tools company that solves security use cases,” not a security company. Its two engines, Chalk and Ocular, are open source under GPL.

Founders John Viega and Mark Curphey previously built companies acquired by Veracode and Sophos. Google Ventures, Syn Ventures, and Blackstone are listed as investors, and Toyota, Blackstone, and Together AI appear as customer logos.

What is Crash Override?

The premise is that scanning after the fact produces inference, while running inside the build produces evidence. Dependencies mutate between commit and container, and a post-hoc scan cannot tell you what changed or when.

Chalk runs inside the build system itself and observes each dependency resolution, each layer mutation, and each file that lands in the final artifact.

The output is a chalk mark embedded in the artifact: source commit, contributors both human and AI, dependency list, and build environment, signed with ed25519.

The four stages

Crash Override describes its own product in four steps, and they map cleanly onto where the data comes from.

Understanding comes first. The Crash Override desktop agent observes what humans and coding agents write before anything reaches the build, working alongside Claude Code, Copilot, and Cursor without an IDE plugin.

Inspection happens next. Chalk runs inside the build and captures dependencies, layers, and the build environment as they happen.

Then comes the tag. Chalk gives the artifact its embedded mark and SLSA Level 3 attestation, signed once at build time and verifiable anywhere downstream.

Tracking closes the loop. Tagged artifacts beacon back from dev, staging, production, and edge, so a container in production resolves back to the commit, or the prompt, that produced it.

The open-source engines

Two repositories under the crashappsec organization carry the core, at roughly 474 stars combined.

Chalk integrates in about five lines of YAML and covers both Docker images and ELF binaries. Ocular deploys via Helm chart with Kubernetes CRDs and handles scheduled and ad-hoc scans.

The commercial platform layers centralized policy management, the posture dashboard and compliance reporting, SSO/SAML with SCIM provisioning and RBAC, self-hosted deployment, audit logging, and support on top.

Querying the data

Crash Override exposes an MCP server, which is a reasonable fit given that the product is largely a queryable record of what shipped.

"crash-override": {
  "url": "https://mcp.crashoverride.com/sse",
  "headers": { "Authorization": "Bearer ${CO_API_KEY}" }
}

Three tools are published: query_containers for what is running in production, query_builds for what shipped and how it was built, and query_agentic_code for what agents wrote and where.

For pipelines, the crashappsec/setup-co-action GitHub Action loads configuration modules for SBOM generation, SAST, and secret scanning.

Performance figures

Crash Override publishes two timing claims. Incremental analysis on a pull request touching 50 files runs in 15 to 45 seconds, and a full scan of a one-million-line monorepo averages three to four minutes.

Both are vendor figures from the product page, not independent benchmarks. Results are cached between runs, so subsequent scans are described as significantly faster.

Getting Started

Chalk is the free entry point and needs no sales conversation. Install the binary, mark a test binary or container, then extract the mark to see what was captured.

The quick start covers the sequence.

The decision worth making early is where the provenance data goes. Chalk’s reporting sinks are configurable, and wiring that to your own storage before rolling it into CI avoids rework later.

When to Use Crash Override

Crash Override fits organizations that need to prove what shipped rather than describe it. Regulated environments where SLSA Level 3 evidence is a requirement are the clearest case, as is incident response.

The AI traceability angle is the newer differentiator. If coding agents are landing production commits with no record of what was prompted, that gap is what the desktop agent addresses.

This is not a vulnerability scanner in the conventional sense. It is a provenance and evidence layer sitting across the toolchain you already run, so pair it with a scanner rather than substituting for one.

For dependency vulnerability analysis alongside it, Dependency-Track consumes the SBOMs that Chalk generates.

Frequently Asked Questions