Review dependencies at the commit you choose.
Inspect selected manifests and lockfiles in a connected GitHub repository. Compare exact package versions with public advisory data and keep the source and coverage evidence.
- Exact package versions from selected manifests and lockfiles
- Known public advisories, available severity, dates, and reported fixes
- Declared licenses and supported public registry release, withdrawal, and integrity metadata
- Selected-source inventory and CycloneDX SBOM evidence
A selected repository, a fixed commit
Connect the repository in Billing, then supply its full commit SHA and dependency file paths. The free preview reads one selected file. Paid checks read up to 25; neither tier installs dependencies or executes repository code.
Advisory matches apply to exact package versions found in the selected source. Unresolved versions and unavailable provider data remain inconclusive. License and deprecation observations reflect supplied metadata and require review.
Repeat and scheduled checks retain the original commit. To check another commit, start a new scan. File selection does not prove that all changed dependencies were included.
A report with clear boundaries.
Each report lists the checks performed, the resources reached, and any checks skipped. Findings include observed or heuristic confidence so you can judge the evidence.
- Sign-in and a current encrypted connection to the selected GitHub repository are required, including for the free preview.
- Choose a full commit SHA and explicit dependency file paths. Package installation, build scripts, and customer code are never executed.
- Version ranges, unsupported formats, unresolved dependencies, and unavailable advisory data remain inconclusive. Missing advisory matches do not prove safety.
- Current registry observations cover supported npm, PyPI, and crates.io identities with explicit public-registry provenance. Unavailable or unsupported observations remain unknown. License metadata is not a legal opinion; reachability and exploitability are not tested.
- Repeat and scheduled checks retain the original commit. Start a new scan to select another commit. Selected paths do not establish an independent version-control diff.
Account and target verification are required for every run. Payment and report access are confirmed by the server.
One-time purchases cover one paid run and do not renew. Monthly plans renew automatically and include four paid runs per billing period for one verified target. Unused runs do not roll over. Cancel through the billing portal before your next renewal; access continues until the current paid period ends. Paid checks may wait for available service capacity. Prices in USD. You’ll see the total before payment. Terms of use · Privacy policy · Data retention and support.
Before you start
What does the free preview include?
1 selected manifest, lockfile, or JSON SBOM. The preview shows up to five findings with the scope and limitations of the scan. Zero findings means no issues were detected by those checks, not a guarantee that none exist.
What does a paid run include?
Up to 25 selected dependency files at one commit per run. A confirmed purchase unlocks the paid allowance and full available findings, plus HTML and PDF exports. Reports remain private to the owning session or account.
Can I check a private target?
Both public and private GitHub repositories require a current selected connection in Billing. Only the saved connection ID is sent with the scan; never include tokens in a repository URL.
