// TOOLS
Security Tools
🎯 Am I affected?
Paste your project dependency file —or your server package list— and I will tell you what to update this week and to which exact version.
The problem is not finding vulnerabilities, it is knowing which ones matter. An
npm audit throws 300 warnings at you and none tells you which is being exploited today, so they all get ignored. Here each dependency is cross-checked against OSV (which version fixes it), EPSS (real exploitation probability) and the CISA KEV catalog (confirmed exploitation). The output is not a list of problems: it is an ordered update plan.
Recognizes:
package-lock.json
package.json
pip freeze
requirements.txt
go.mod
composer.lock
Gemfile.lock
Cargo.lock
dpkg -l
Up to 400 dependencies per query. Only name+version pairs leave your browser: never your code or your project paths.
Asset context
Same as in the CVE prioritizer: a vulnerability in an Internet-facing service is not the same as in an internal script.