Find the known-vulnerable packages in your project
Drop in a lock file — or paste it — and every resolved dependency is checked against the OSV vulnerability database. You get exactly which packages carry known CVEs, how serious each one is, and the version that fixes it. Instant, analysed in memory, nothing stored.
Drop a lock file here, or
package-lock.json · requirements.txt · go.mod · Gemfile.lock · composer.lock · pom.xml · Cargo.lock
Tip: lock files with exact resolved versions give the most accurate results. A plain package.json or unpinned requirements.txt is matched on a best-effort basis.
What it checks — and how it helps
Seven ecosystems
npm, PyPI, Go, RubyGems, Composer, Maven and Cargo — read straight from your package-lock.json, requirements.txt, go.mod, Gemfile.lock, composer.lock, pom.xml or Cargo.lock.
Backed by OSV
Every resolved package is matched against the OSV database — the open source of truth (GHSA, PySec and more) that aggregates advisories across the ecosystem.
Rated by severity
Findings are graded critical through low, each with the exact version that resolves the CVE — so you can fix what actually matters first.
Explained, then fixed
Each finding links to a plain-English write-up of the flaw — how it works and where the fix lives. Need them remediated? Our vetted engineers can do it for you.
Prefer the command line? Scan locally.
The scanner above is perfect for a quick check. To scan a whole repository — or wire it into CI so every build is checked — use our open-source command-line tool. It's a single file with no dependencies, it only ever reads your lock files, and it returns a proper exit code for pipelines.
- Recurses a project and finds every lock file
- Sends only package names and versions — never your source
- Fails a build on the severity you choose