Privacy.

The file you drop is read and parsed by code running in your browser. It is not sent to this server, and there is no request anywhere in the application that carries its contents. This is why the tool works the way it does rather than a policy that could be relaxed later: a lockfile is a map of a company’s internal package namespace, and dependency-confusion attacks begin by learning those names.

To look anything up, package names and versions have to leave your browser. Before a scan runs you are shown exactly what that list contains and can remove anything from it.

Anything resolving from a private registry is withheld automatically, without being asked. A package.json records no registry hosts, so for a manifest that detection is not possible and the tool says so rather than implying it happened.

Those names and versions reach:

• api.osv.dev— the advisory database, for every ecosystem
• api.deps.dev— an independent second opinion on each version
• registry.npmjs.org— npm advisories, and version and size metadata
• packagist.org— PHP advisories — the only independent cross-check Composer packages have
• pypi.org, repo1.maven.org, proxy.golang.org, rubygems.org, crates.io, api.nuget.org— published versions, sizes and deprecation status

Two sources receive no package names. CISA’s exploited-vulnerabilities catalogue is downloaded whole and matched locally, and FIRST’s exploitation forecast is asked about CVE identifiers only.

Each of these is an independent service with its own privacy practices, which this notice cannot speak for.

No scan is saved. There is no account, no scan history and no database of results — not as a setting, but because the interface the application uses to store a scan implements no method that could write one.

No cookies, and no analytics. There is no tracking script, no tag manager and no product-analytics service. A fresh visit writes nothing to your browser at all. If you choose a light or dark theme, one value named theme is saved in your browser so the choice survives a reload; it never leaves your device and clearing site data removes it.

No visitor identifier is created. The application does not mint a session id, a device fingerprint or a hashed IP for anonymous use.

Requesting a page or running a scan means connecting to a server, so your IP address and the request itself are visible to it and to the hosting provider in the ordinary course of serving and protecting the site. The same applies to each third-party service listed above. This is stated because it is true of any website, and a privacy notice that omitted it would be misleading rather than reassuring.

If what the tool sends or stores changes, this page changes with it. The claims here are meant to be checkable against the behaviour, so a gap between the two is a defect.

Questions, or something here that does not match what you observe? The scan page shows every source a given scan consulted, including the ones that found nothing.