Check your dependencies for known vulnerabilities
Upload a lockfile and every dependency is checked against OSV.dev, the open vulnerability database maintained by Google/OpenSSF — free, no signup required.
The package-lock.json file generated by npm install, in your project root.
Nothing is stored. Nothing is logged. Your file is read into memory, parsed into a plain list of package names and versions, checked against OSV.dev's public vulnerability database, and discarded the moment this scan finishes. It is never written to disk, never saved to a database, and never appears in a server log — there is no account and nothing to look back at, even for us.
Known CVEs, not just staleness
Every dependency is checked against real, published vulnerability advisories — not just whether a newer version exists.
Nothing kept, nothing logged
No account, no database row, no file written to disk. The upload exists only for the seconds it takes to run this scan.