Skip to content
Private Beta ·invite-only access. Reach out to get in.
How it works

From CVE noise to verified fixes.

Tell us what you run. We tell you what is vulnerable, rank it by real risk, and, on Max, an AI agent fixes your dependencies while we verify every fix.

01Free · €0

Know

Get told when something you run is seriously vulnerable.

  • Declare your technologies and versions
  • Major CVEs matched to your stack
  • Email alerts
02Premium · €59.99/month

Prioritise & track

See everything that affects you, ranked, and work through it.

  • High, critical and major CVEs, enriched with KEV, EPSS and exploits
  • Lockfile scanning: vulnerable packages and the version that fixes them
  • Triage statuses with history: open, in progress, deferred, risk accepted, closed
03Max · €119.99/month

Fix & prove

An AI agent applies the fixes. We verify each one and keep the record.

  • Remediation plan per app: what to upgrade, how, in what order
  • Agentic patching with Claude Code or a GitHub Action
  • Slack, Telegram, REST API, MCP server, AI fix instructions
Get started · about 10 minutes

Five steps, once.

  1. 1Sign up
    vulneraibility.com/login

    Email code or passkey. No card for Free.

  2. 2Describe your stack
    Settings → get started

    Add the technologies you run, with versions. Versions are what make matching exact.

  3. 3Group it into apps
    Settings → apps

    One app per product or service, with its context: internet-exposed, behind a WAF, data sensitivity. This drives the risk ranking.

  4. 4Turn on alerts
    Settings → notifications

    Email on every plan; Slack and Telegram on Max.

  5. 5Add your lockfiles
    Dashboard → dependencies

    Upload package-lock.json, poetry.lock, go.sum… or send them from CI on every push (Settings → get started has the snippet).

From then on you only hear about CVEs that touch your stack. Triage them on the dashboard; the Risk page ranks your apps by exposure.

Agentic patching · Max

Fixed, not just found.

On the dependencies page, each app gets a remediation plan: every vulnerable package, the version that fixes it, how to apply it, and in what order. An agent can then carry it out, end to end.

  1. 1Plan

    We compute each upgrade, check the target fixes every advisory, rank by real risk.

  2. 2Run

    Your agent starts a tracked patch run on a new branch.

  3. 3PR

    It edits the files, runs your tests, opens the pull request.

  4. 4Verify

    We rescan the patched lockfile: fixed, partial or regressed.

  5. 5Close

    You merge. The vulnerabilities leave your dashboard.

Choose how much to automate

Manual
Your developers

Read the plan in the dashboard and apply it. Each item comes with the exact command or override to paste.

Assisted
Claude Code, on a developer’s machine

Connect it once with an API key and ask it to fix an app. You review the PR it opens.

Autonomous
A scheduled GitHub Action

Opens patch PRs on its own, e.g. every Monday. You only review and merge.

Setup commands and ready-to-paste workflows are in the docs. Supported: npm, yarn, pnpm, bun, PyPI, Go, Cargo, RubyGems and Composer.

We never touch your code

Your agent works in your repository with your credentials. We store the PR link it reports, nothing more.

Every fix is verified

A run is marked verified only after we rescan the new lockfile. It cannot be ticked by hand.

Full audit trail

Who or what changed each run, when, with which branch, commit and PR. Append-only.

Start with your stack.

Free to start. Upgrade when you want the fixing done for you.

Start freeCompare plansCheck a lockfile