Terms.

DepAudit is free, needs no account, and is offered as-is. You may use it for personal or commercial work, including on private and proprietary projects — the lockfile never leaves your browser, which is what makes that reasonable.

Please use it at a human pace. It runs on free, unauthenticated public advisory and registry APIs, and automating it at volume risks the rate limits those services apply — for everybody, not just for you. If you want this in a pipeline, run osv-scanner in CI instead; it is built for that, and this tool is checked against it.

A result with no findings is not proof that a project is safe. It means no database consulted, at the moment it was consulted, published an advisory matching those exact versions. Those are different claims, and the difference is the whole reason this page exists.

Three limits are structural rather than temporary. DepAudit receives a list of dependencies, not your source code, so it has no way to tell whether vulnerable code is ever actually reached, and never claims otherwise. It can only report what its sources contain, so an advisory that has not been published, or has been published without version information, will not appear. And a manifest such as package.json declares ranges rather than resolved versions, so a result from one is labelled best-effort and means less than a result from a lockfile.

Advisory records, severities and affected-version ranges come from third parties and are reproduced as published, including where two of them disagree. They can be wrong, incomplete or late. Every finding names its source and links to the original so you can check it, which is the point — DepAudit is a way to see the evidence, not a substitute for your own judgement, your own security review, or the other controls you run.

To the fullest extent the law allows, DepAudit is provided without warranty of any kind and its authors accept no liability for any loss arising from its use or from reliance on its output.

Advisory text is reproduced under its publisher’s licence, and the licence is shown on every finding — the GitHub Advisory Database under CC-BY-4.0, CISA’s catalogue under CC0, and others as they appear. If you republish anything you take from here, the original publisher’s terms travel with it.

What the tool sends and stores is described in the privacy notice, which is written from the behaviour rather than from a template.

These terms may change as the tool does. Continuing to use it after a change means accepting the updated version.