Find the vulnerabilities that affect your code.

Connect a repository to see which advisories match your dependencies, what to check first, and what your team has already fixed.

Connect GitHub Browse the free feed

Start with a lockfile

acme / storefrontExample project

Version match

An affected version is in your lockfile

One dependency in the storefront project matches the advisory’s affected range.

Installed: example-package@1.2.3
Fixed version: 1.2.4
Assessed commit: 7f92c4d

Check where this version is deployed

Advisory and risk sources

OSV GitHub Advisory Database CISA KEV FIRST EPSS

From advisory to verified fix.

Start with one project. Give your team the evidence to make the next call.

Know which packages are affected.

Match exact versions from your lockfile to published advisories. See which version was assessed and where the fix starts.

See how matching works

GitHub

GitLab.com

npm lockfiles

Start with the software you ship.

Pick a repository to monitor or upload an inventory. Review dependency and CI settings at the assessed commit.

Get alerts about your projects.

Turn on email alerts for new dependency matches in the projects you follow.

See alert settings

Give every finding a next step.

Record what you checked, what you changed, and the evidence that the fix reached production.

Read the response guide

Follow the security feed for free.

Read advisories with links to their original sources. Follow the feed without a Wisesama account.

Open the public feed

Email updatesSubscribe with a verified address RSSAdd the feed to your reader API & MCPLook up public advisories in your tools

Before you connect

Explore the guides

Does a match mean my production app is vulnerable?

It means a reported affected package version is present in the assessed inventory. You still need to verify deployment, configuration, feature use, and reachability. Wisesama keeps that distinction visible.

What can Wisesama assess today?

Exact npm and PyPI package versions from supported lockfiles or pinned inventory JSON. Runtime notes are context; container images, operating-system packages, and code reachability are outside this workflow.

Does connecting a repository let Wisesama change my code?

The assessment integrations use read access. GitHub Contents permission covers selected repositories; GitLab read_api covers API reads under your user. Wisesama processes supported inventory files and allowlisted configuration for baseline checks. It does not push code in this workflow.

Can I try it without connecting a repository?

Yes. Create a project with a supported uploaded inventory, or browse the free public feed without creating an account.