Nimstead Assure is a self-hosted vulnerability management tool for Linux, Windows and application dependencies. It identifies vulnerable packages, prioritises upgrades and checks whether a fix actually removed the finding.
I built it to help with the decisions after a scan: which fix to apply and how to keep the service running through the change. Assure keeps evidence of the result so you can check what happened.
Getting the findings right
Linux distributions often backport security fixes without adopting the latest upstream version number. Assure matches installed packages against OSV advisories using each distribution's version rules and source-package names, so those fixes are recognised.
On Windows, Assure checks Microsoft's fixed builds and uses a curated map of third-party applications. It reads application dependencies from CycloneDX or SPDX software bills of materials (SBOMs). A finding from an SBOM confirms that the component is present; whether its vulnerable code is reachable is a separate question.
The dashboard groups findings into upgrades and explains each recommendation's ranking. Known exploitation takes priority, followed by exploitation probability, severity and the machine's importance and exposure.
Testing what happens when a patch breaks something
In the Debian sandbox run, a perl-base upgrade succeeded but the canary service failed. Assure restored the previous package and checked that the service recovered.
The old package was no longer in the archive, so the agent used a rollback copy it had rebuilt from the installed files and package metadata before upgrading.
That rollback copy is required for every reversible job. Before rollout, a dry run checks the scope of the change. Canary machines receive the update first, and a failed health check triggers rollback. After a healthy update, Assure checks fresh inventory and only marks the job as fixed if the finding has gone.
Where automation stops
Administrators choose whether to enable remediation on each machine. They can keep Assure in recommendations-only mode, approve fixes individually or allow automatic rollout through canaries.
Rollback restores package files and the package database. Restoring changes that install scripts make elsewhere requires the zypper path with snapper. Windows application updates through winget cannot be rolled back, so they always require human approval.
Assure records every detection, decision and fix in a hash-chained ledger. Signed evidence packs can be checked offline and used in assessments against controls such as Cyber Essentials and ISO 27001, though they don't certify an organisation.
Running Assure
The server uses Python with FastAPI and PostgreSQL, and the interface is built in React. The agent is a single Python file using the standard library; Docker Compose runs the server.
It's still early access. The test records and known gaps show what has been tested on real machines and VMs, and what remains unproven. Start with test machines and the installation guide.
Nimstead Pulse lets you explore the public vulnerability data used to prioritise fixes.
