SOFTWARE SUPPLY CHAIN SECURITY

Know what your
dependencies know.

Upload a project archive and get a focused, evidence-based scan for known compromised packages and supply-chain exposure.

01 / SCAN A PROJECT

Drop your project here

We inspect manifests, lockfiles and installed package metadata. Your archive is processed temporarily and deleted after the scan.

⌁

↑ Choose a ZIP archive or drag and drop it here · max 50 MB

HOW IT WORKS

Prepare a ZIP of the project you want to review. The scanner reads dependency metadata only; it does not install or run the uploaded project.

Keep the dependency manifests and lockfiles that describe the project.

package.jsonpackage-lock.json · yarn.lockpnpm-lock.yaml · bun.lockbrequirements.txtpyproject.toml · uv.lockpoetry.lock · Pipfile.lock

Include installed dependencies when you want stronger evidence about what was actually installed.

node_modules/Python site-packages/*.dist-info/METADATAPKG-INFO

Protect sensitive data and keep the upload focused and lightweight.

.env · credentials · private keys.git/ · cache foldersbuild/ · dist/ · coverage/Large media and unrelated binaries

SUPPORTED TODAY JavaScript / npm Python / PyPI Project files only Go modules, container images and GitHub Actions are not supported yet.