Every known vulnerability
starts as a version number.
A site is rarely broken into through something new. It is broken into through a library that shipped a fix eighteen months ago and never got installed. We read the versions a website is running and match them against the public record of known vulnerabilities.
Matched against osv.dev
Every detected package and version is checked against the open vulnerability database. Not our list - the same public record the maintainers publish to, so you can verify any finding yourself.
osv.devThe release line stopped getting fixes
A version with no published vulnerability is not safe if its release line is no longer maintained - the next one simply will not be patched. We track the support windows and say when a stack has crossed that date.
How far behind, and for how long
Each version is placed in its own release history, so "behind" is a distance and not an opinion. TLS certificate expiry is checked in the same pass.
We audit the stack, not the traffic.
If you came looking for one of these, we are the wrong tool and would rather say so now than after you have signed up:
- Malware or virus scanning. We do not inspect files or scripts for malicious code.
- Phishing detection. We do not judge whether a site is impersonating another.
- Penetration testing. Nothing here probes, injects or attacks anything - every audit is a read.
- Code review. We see what a site serves publicly. We never see the repository.
What we do is narrower and checkable: read the software a site runs, read its versions, and compare both against the public record.
Audit once, or watch it
A single audit is free and needs no installation - enter an address and read the result in about two minutes. Watching is the part that matters for security: a vulnerability published next month against a version you already run is the one that gets you, and only a scheduled re-audit finds it.
Scheduled alerts for vulnerabilities, end-of-life and version drift are part of the paid plans; a one-off audit is not.