Nothing is uploaded. No account.
Scan a project.
Check a lockfile against known advisories. Every finding names the database it came from, and every suggested upgrade has been verified to exist.
- Parsed in your browser
- Every source attributed
- Minimal verified upgrade
8 ecosystems, 28 formats
- npm (Node.js)
bun.lock, bun.lockb, npm-shrinkwrap.json, package-lock.json, package.json, pnpm-lock.yaml, pnpm-lock.yml, yarn.lock
- PyPI (Python)
dev-requirements.txt, pdm.lock, pipfile.lock, poetry.lock, pylock.toml, pyproject.toml, requirements_dev.txt, requirements-dev.txt, requirements.txt, uv.lock
- Maven (Java / Kotlin)
buildscript-gradle.lockfile, dependency-tree.log, dependency-tree.txt, gradle.lockfile, maven-dependency-tree.txt
- NuGet (.NET)
packages.lock.json
- Go
go.mod
- RubyGems
gemfile.lock
- Packagist (PHP / Composer)
composer.lock
- crates.io (Rust)
cargo.lock
Your file is parsed in this browser and never uploaded. For yarn.lock, add your package.json too — it is the only way to tell runtime dependencies from build-time ones.
A package.json on its own gives a quick look at your declared dependencies, but it lists no transitive ones — and that is where most findings are. A lockfile is the complete answer.
Checking one package rather than a whole project? Look up a single package.