Free Online CVE & Lockfile Vulnerability Scanner
Audit your JavaScript, Python, Rust, Go, and PHP dependency trees in seconds. Cross-reference real-time CVEs, GHSA alerts, and severity scores without installing any CLI.
All Major Ecosystems
Supports package-lock.json, yarn.lock, Cargo.lock, requirements.txt, and go.sum.
Google OSV Database
Real-time batch ingestion across OSV, GHSA, NVD, and PyPA databases with full CVSS v3 vectors and alias hydration.
Zero Storage & Private
Your source code is never stored. Scans process in ephemeral RAM sandboxes and discard payload data immediately after reporting.
How to Scan for CVEs in 3 Steps
Upload or Enter Repo
Paste any public GitHub repository URL or drag & drop your lockfile into the DevAudit Scanner.
Automated OSV Resolution
The scanner extracts every direct and transitive dependency package, querying Google OSV in parallel.
Get Fixes & Badges
Receive exact version upgrade recommendations and embed your verified passing badge on GitHub.