free lockfile check
Check your lockfile for known vulnerabilities
No account needed. Upload a lockfile and get every vulnerable package, its advisories and the version that fixes it, with a link you can share for 30 days.
Supported: package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, bun.lock, requirements.txt, poetry.lock, uv.lock, Pipfile.lock, go.mod, go.sum, Cargo.lock, Gemfile.lock, composer.lock.
Privacy: the file is read and discarded, never stored. What is kept is the report (vulnerable packages and their advisories, no other package names) for 30 days, at a link that anyone who has it can open. Package names and versions are sent to OSV.dev to look up advisories.