Security testing, with the evidence attached
Less guesswork.
More security
you can explain.
Turn software inventories, release artifacts and API contracts into clear findings. Know what needs attention—and where you still need answers.
Five components. Real advisory lookup. No account or card.
Start with what you have.
An inventory, a release artifact, an API contract or an authorised website.
One platform. Four starting points.
Bring the evidence.
Find your next action.
Software composition
Connect the software you run to vulnerability evidence. See affected versions, priority factors and unresolved identities.
CSV · CYCLONEDX · SPDX ↗Binary assurance
Inspect release artifacts for hardening and secret signals, without executing the uploaded binary.
PE · ELF · MACH-O ↗API contract audit
Find gaps in authentication and transport declarations before you run tests against an API.
OPENAPI · SWAGGER ↗Website baseline
Check transport, headers and cookies on one public page with a bounded passive assessment.
AUTHORISED PUBLIC URL ↗New · Free local tool
Before you scan it,
can you trust the inventory?
Missing versions. Ambiguous identifiers. Duplicate references. Find the gaps that make an SBOM harder to use, before you hand it to a customer or a scanner.
Runs in your browser. Your file stays on your device.
A useful answer includes the gaps.
Next step: request an updated inventory from the supplier.
The product, visualised
Bring the scattered pieces into view.
An inventory turns a scattered software estate into a starting point for investigation.
Illustrative animation · Silent · Pause any time
From input to a defensible decision
A finding is the start.
Understanding it is the point.
Keep the observed facts, the interpretation and the follow-up together. A complete rescan can verify a change without erasing the decisions your team already made.
Read the methodology ↗Start with a bounded check
Choose an input and see exactly which technique will assess it.
Understand the evidence
Inspect the observation, priority factors and anything the check could not establish.
Review, remediate, verify
Record a decision and reassess the same scope to see what changed.
Built around your next conversation
Make security easier to act on.
For software suppliers
Bring evidence to the buyer review.
Check inventory quality, inspect release artifacts and review API declarations before the next security questionnaire lands.
Explore supplier assurance ↗For lean security teams
Know what deserves a closer look.
Start from the inventory you already have. Review vulnerability evidence and surface the unknowns that need follow-up.
Explore evidence-led triage ↗Before you start
Clear scope. No surprises.
What can I try before signing up?
Scan up to five software components with the free scan, or inspect a CycloneDX or SPDX JSON file with the local SBOM readiness checker. Neither requires an account or a payment card. The full workspace starts with a 14-day paid-plan trial; a card is required for that trial.
Do you need my source code?
No. Composition analysis starts from an inventory or SBOM. The other modules use a binary, API contract or authorised public URL. Coverage depends on the evidence supplied and the advisory sources available to your deployment.
Does a passing result mean my product is secure?
No. Each check has a defined scope. Unresolved identities and unavailable advisory coverage stay visible. Static contract checks cannot prove runtime authorisation, and passive website checks are not a penetration test.
Which capabilities are still planned?
Authenticated crawling, API fuzzing, network probing, dynamic sandboxing and attack-path validation are not current execution coverage. See each product page for the techniques available today.