Which of your dependencies actually need fixing?

Paste a public GitHub or GitLab repository. Scandar checks every lockfile against OSV.dev, reads what the code imports, and shows the few advisories that matter first. No account needed.

Lockfiles from npm, pnpm, Yarn, PyPI, Go, Cargo, Composer, RubyGems. A report is reused for an hour, and each visitor can start 8 new scans an hour.

What the report shows

The same analysis as the dashboard, for a repository you do not have to install anything on.

Fix now, plan, later

Each vulnerable package gets a priority from its severity, its usage and the fix available.

What your code reaches

Imports are read, so packages nothing in the code uses stop crowding the list.

Plain words

What an advisory allows, when you are exposed, and what the upgrade changes.

Shareable report

A public link for the repository, and a README badge that stays up to date.

Your own repositories

Sign in to scan private repositories, follow them over time, and get a pull request that moves every fixable package to its patched version.