StayAwakeBot documentation

saw hunts self-propagating supply-chain malware in your repositories, lockfiles, installed dependency trees and your machine's start-up surface. It remediates through a pull request and gates CI, so an infected change cannot merge. A default scan is offline, needs no configuration, and its exit code is the verdict.

For developers who run npm install, editor auto-tasks and agent tooling, and for the people who keep an organisation's repositories gated.

Start here — Your first scan · Gate a repository

Do a task — scan local code · scan GitHub repositories · fix findings · gate CI · scan on clone · audit a machine · harden a repository

Look it up — CLI reference · configuration · exit codes · advisory database

What the tool promises — trust model · verdicts · fail closed · safety envelope · credential hygiene

The package also ships an unrelated uptime monitor, stayawake-health-check — see configuration.

Which version you are reading

Each release keeps its own copy of these pages, and the version selector at the top switches between them. latest follows the current documentation.

Documented versions begin at 0.6.2. Earlier releases were published before this site existed, so there are no pages describing them — rather than reprinting today's documentation under an older number, which would describe behaviour those versions do not have. If you are running something earlier, saw --version and saw <command> -h describe the copy you actually have.