Feature

Security Intelligence

When a new vulnerability affects something in your stack, you should know before your customers ask about it.

How it works

  • During each scan, we detect what libraries and services your application uses (from JS bundles, headers, and network requests)
  • We monitor NVD, GitHub Advisories, and CISA KEV daily for new vulnerabilities
  • When a new vulnerability affects something in your detected stack, we send you an alert
  • The alert includes the CVE, affected library version, severity, and whether your detected version is in the affected range

Security Intelligence Alert

CVE-2026-XXXXX affects lodash 4.17.21

A prototype pollution vulnerability was published affecting lodash versions below 4.17.22. This library version was detected in your application at app.example.com during your last scan. Severity: HIGH. Upgrade to lodash 4.17.22 or later.

Not just CVE scanning

Traditional vulnerability scanners check your dependencies against a CVE database. We do that too, but from the outside. We detect library versions from your production JavaScript bundles, not from your package.json. That means we see what's actually deployed, not what's in your repository.

Try a free scan See pricing