// TOOLS
Security Tools
🎯 Am I affected?
Paste your project dependency file —or your server package list— and I will tell you what to update this week and to which exact version.
The problem is not finding vulnerabilities, it is knowing which ones matter. An
npm audit throws 300 warnings at you and none tells you which is being exploited today, so they all get ignored. Here each dependency is cross-checked against OSV (which version fixes it), EPSS (real exploitation probability) and the CISA KEV catalog (confirmed exploitation). The output is not a list of problems: it is an ordered update plan.
Recognizes:
package-lock.json
package.json
pip freeze
requirements.txt
go.mod
composer.lock
Gemfile.lock
Cargo.lock
dpkg -l
Up to 400 dependencies per query. Only name+version pairs leave your browser: never your code or your project paths.
Asset context
Same as in the CVE prioritizer: a vulnerability in an Internet-facing service is not the same as in an internal script.
What it does, what data it uses and its limits
- What it does
- Reads your project’s dependency file or your server’s package list and tells you what to update first and to which version, ordered by real-world exploitation.
- What data it uses
- The file is read in your browser and only package names and versions are sent. Our server looks them up in OSV.dev (affected and fixed versions) and adds FIRST’s EPSS and CISA’s KEV catalogue.
- Limits
- It only finds published vulnerabilities: it does not analyse your code.
- A vulnerable package does not mean your application uses the affected part.
- Up to 400 packages per check; beyond that, the first ones are analysed.