Check a project for vulnerable packages
Paste a public GitHub repository, or upload its package files. You'll see which npm and Composer packages have known vulnerabilities, worst first, in under a minute.
Questions
What does the free scan check?
Every npm and Composer package in the files it reads, against OSV.dev, the open vulnerability database that includes the GitHub Advisory Database. With a lockfile it checks the exact versions you install, including the packages your packages pull in. It also flags Node and PHP versions, and official Docker base images, that are past or near the end of security support.
Do you keep my files?
No. Uploaded files are read in memory to run the scan and then dropped. For public GitHub repositories we keep the summary for 30 minutes so a shared link doesn’t rescan the same repo for every visitor.
Can it scan private repositories?
Not without an account, because we’d need your permission to read them. Sign in with GitHub and pick the repos you want; 3 projects are free, and they’re rescanned every week.
Why is there a limit?
Each scan reads from GitHub and the advisory database, so the free scan allows a few an hour per visitor. Signed-in accounts get far more.
Looking after PHP projects? How the Composer checks work