Check a lockfile.
Drop a dependency file and see which packages match exploited, likely-to-be-exploited or critical CVEs. By default it runs in your browser and nothing is uploaded.
package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Cargo.lock, go.mod, composer.lock, Gemfile.lock or pom.xml. Or paste the contents:
The default check uses the exploited, likely and critical CVEs, downloaded to your browser from /agent/cves.csv. Matching is by package name and version, so it can miss things and can flag things that do not apply. A clean result does not mean you are safe. It is not security advice. Check each hit against the official record.
A saved stack stays in this browser (local storage, no cookie) and is never sent anywhere. It also lets the page mark what is new since your last check.