How it works
Open a package-lock.json, composer.lock, requirements.txt with pinned versions, go.mod, go.sum, Cargo.lock or Gemfile.lock. The tool reads the exact versions and compares them with OSV advisories for that ecosystem, refreshed daily. Data comes from OSV.dev. Versions it cannot compare are marked for a manual check, and advisories can be incomplete, so confirm each result.
Privacy
Your file is read by your browser and is never uploaded. Your browser downloads small public data files from VulnFeed, chosen by a hash of each package name, so your package names are not sent as search terms and no third party is contacted.