Fixed. Proven.

01 — Detect

$ git clone --branch v0.7.2 https://github.com/Nimstead/assure.git && cd assure
$ cp .env.example .env
# Set a long random POSTGRES_PASSWORD in .env.
# Set NIMSTEAD_UPDATE_CHANNEL=preview to receive preview updates.
$ docker compose up -d
Open http://localhost:8000 and add your first machine.

$ export NIMSTEAD_TOKEN=<TOKEN>
$ curl -fsSL --proto '=https' https://<server>/install.sh \
    | sudo --preserve-env=NIMSTEAD_TOKEN sh
$ unset NIMSTEAD_TOKEN
Nimstead agent installed;
reporting every 6 hours.

> $env:NIMSTEAD_TOKEN = "<TOKEN>"
> irm https://<server>/install.ps1 | iex

02 — Prioritise

Fix first. Not everything at once.

Assure ranks by what's being exploited, not by how scary a score looks. The home screen shows upgrades, not a wall of CVEs, and every ranking comes with its reasons in plain words.

1. Known exploitedOn the CISA KEV list? It goes to the top, every time.Exploited in the wild (CISA KEV)
2. Likely to be exploitedFIRST EPSS: the chance of exploitation in the next 30 days.4.2% chance of exploitation in 30 days (EPSS)
3. SeverityCVSS, weighed with the two above rather than on its own.Critical severity (CVSS 9.8)
4. Your contextHow critical the machine is, and whether it faces the internet.Internet-facing asset
5. Can it be fixedIf no fix exists yet, it says so instead of nagging.No fix yet — mitigate or accept

03 — Fix safely

04 — Prove

# get verify.py from /api/evidence/verify.py and
# check its SHA-256 at /api/evidence/public-key
$ pip install cryptography
$ python verify.py pack.json pack.sig public_key.pem \
    --expect-fingerprint <FINGERPRINT>
OK: signature valid, ledger chain intact

Each control is reported as met, not met or no activity. A deadline control reports no activity when nothing was fixed and nothing was overdue in the period.

05 — Where it runs

Tested on real machines. Here are the limits.

The verified rows have run on real or virtual machines. Partial rows separate what was observed from what remains unproven. Read the full evidence and known gaps.

06 — Security

Your servers. Your keys.

Self-hosted

You run the server: Python 3.14 and PostgreSQL 17, at a URL you choose. Your inventory, findings and evidence live there.

Bounded agent actions

One Python file, standard library only; on Windows it brings its own signed Python runtime. It accepts defined job types, not arbitrary shell commands from the server. Local opt-in and job validation constrain what can change. Don't take our word for it: read the source.

Keys you hold

Signing keys can stay in HashiCorp Vault transit, and ledger checkpoints can go to S3 object lock, outside the database.

Updates only we can sign

Agents and the server install a release only if it's signed by the Nimstead release key. That key never touches your server, so a compromised server can't push code to your machines. If a server update isn't healthy within 5 minutes, it rolls back and restores the database.

Sign-in your way

SSO over OIDC with PKCE, domains verified by DNS. Require SSO and keep an admin break-glass account. Admins who sign in with a password must use two-step sign-in. Scripts get read-only API tokens.

Found a vulnerability? Email security@nimstead.systems. Read the disclosure policy.