Everything you need for release risk control

Dependency tree resolution with transitive visibility, lockfile parsing, and package metadata normalization across supported ecosystems.

Correlates OSV, NVD, and GHSA advisories, then enriches findings with CVSS details, EPSS probability, and CISA KEV status. Filter by match type (range or exact version) to isolate advisory classes for review.

Combines external exploit signals (EPSS / KEV) with available code-level context and package usage evidence to prioritize real risk first.

Detects and normalizes license metadata, flags unknown or unresolved entries, and provides package-level evidence for legal review.

Define thresholds for severity counts, CVSS ceilings, unresolved licenses, and exploitability conditions. Get explicit PASS / FAIL verdicts.

Export CycloneDX SBOM, SARIF, CSV, UBOM, and PDF outputs with correlated findings and remediation context for audit and pipeline workflows.

Scan container images for dependency and vulnerability risk. Upload a Docker-save tarball or use an image reference to pull from a registry; get SBOM and vuln correlation for image layers.

Assess the net security risk of any version upgrade before patching. Compare vulnerability exposure on both the current and target version, surface compatibility changes, and get a clear upgrade recommendation — directly inside the vulnerability detail panel.