Dependency vulnerability scanning
Know which of your dependencies are vulnerable
Most of the code you ship comes from open-source packages. BugSafer reads your lockfiles, matches every resolved package against the OSV.dev vulnerability database, flags known-malicious packages and license-policy violations, and exports an SBOM for your records.
No credit card · Pay per scan
What dependency scanning includes
Live CVE matching
Packages are matched against OSV.dev at scan time, so newly published advisories show up on your next scan.
Malicious packages
Packages with published malicious-package advisories are flagged alongside ordinary vulnerabilities.
License policy
Flag dependencies whose licenses conflict with your policy before they reach production.
SBOM & SARIF
Export a software bill of materials, and SARIF for GitHub code scanning.
How it works
- 1
Connect your repository — no CI configuration needed.
- 2
BugSafer reads supported lockfiles: package-lock.json, requirements.txt, Pipfile.lock, poetry.lock, Gemfile.lock, composer.lock, go.sum, Cargo.lock and packages.lock.json.
- 3
Each package version is checked against OSV.dev.
- 4
Upgrade the affected packages using the fixed versions in each finding.
Frequently asked questions
Which ecosystems are supported?
npm (package-lock.json), Python (requirements.txt, Pipfile.lock, poetry.lock), Ruby (Gemfile.lock), PHP (composer.lock), Go (go.sum), Rust (Cargo.lock) and .NET (packages.lock.json).
Where does the vulnerability data come from?
OSV.dev, an open vulnerability database that aggregates advisories from sources including the GitHub Advisory Database and ecosystem-specific databases.
Do I need a lockfile?
Yes — lockfiles give exact resolved versions, which is what makes vulnerability matching accurate.
Scan your first repository free
Connect GitHub and get a security score with prioritized findings in minutes. 2 free credits, no credit card.