For lean security & IT teams
A long finding list.
A clearer next move.
Start with the software you run. Review affected versions and exploit evidence together, and keep unresolved products in sight.
No repository access. No agent. No account for the free scan.
Start with what you have.
An inventory, a release artifact, an API contract or an authorised website.
Make the first investigation count
Severity starts a question.
Evidence helps answer it.
Composition findings combine applicability with prioritisation signals. Review the rationale before deciding what your team should investigate first.
Identify the software
Upload CSV, TSV, CycloneDX or SPDX in the workspace. Review uncertain identities instead of silently losing them.
Inspect the priority factors
Review OSV applicability, available CISA KEV and FIRST EPSS enrichment, and the asset context behind the decision.
Keep the unknowns in view
An unanswered product is a follow-up item. Missing advisory coverage does not become a clean result.
The product, visualised
Turn loose signals into a clearer picture.
Resolve the identity, inspect the evidence and keep the remaining questions visible.
Illustrative animation · Silent · Pause any time
An example of the decision, not a live scan
Three outcomes worth separating.
Affected
A supported source matches this product version. Review the advisory and the exposure context.
Needs review
The software identity is uncertain. Confirm the candidate before relying on applicability.
Unanswered
The available sources cannot establish applicability. Obtain more evidence before closing the question.
Choose the next check
to fit the question.
Add static binary checks, API contract auditing or a bounded passive website baseline when that evidence helps. Authenticated crawling, fuzzing and attack-path validation remain planned.
Compare available modules ↗