{"product_id":"quickscan-dependency-supply-chain-scan","title":"Dependency \u0026 Supply-Chain Scan – Known-Vulnerable Packages in the Code You Ship","description":"\u003cp\u003e\u003cstrong\u003eMost of the code in your product was written by strangers. This checks which of it has a known hole.\u003c\/strong\u003e\u003c\/p\u003e\u003cp\u003eThe Dependency \u0026amp; Supply-Chain Scan reads the dependency and lock files in a code folder you own — npm, Python, Go, Ruby, PHP, Java, Rust and .NET — and checks every package and version against the free, public OSV vulnerability database. It leads with the vulnerabilities that already have a fix you can install today, separates the packages you chose from the ones they dragged in, and never installs, runs or uploads any of your code.\u003c\/p\u003e\u003ch3\u003eWhat it checks\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eEvery dependency and lock file in the folder, across eight package ecosystems\u003c\/li\u003e\n\u003cli\u003eEach package and version against the OSV public vulnerability database\u003c\/li\u003e\n\u003cli\u003eWhether a fix exists, and whether the vulnerable package is one you chose or one that came along with it\u003c\/li\u003e\n\u003cli\u003eMissing lock files and unpinned versions that make every build a different build\u003c\/li\u003e\n\u003cli\u003eAbandoned packages, and names that impersonate popular ones\u003c\/li\u003e\n\u003cli\u003eLicence signals that a buyer or a customer's lawyer would ask about, reported as information only\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eWhat you get\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eA written PDF report emailed back to you, typically within one business day.\u003c\/li\u003e\n\u003cli\u003eEvery vulnerable package rated Critical \/ High \/ Medium \/ Low, with the version that fixes it where one exists.\u003c\/li\u003e\n\u003cli\u003eAn executive summary you can hand to a client, an insurer or an acquirer asking about your software supply chain.\u003c\/li\u003e\n\u003cli\u003eUpgrade-first remediation: what to bump, in what order, and what cannot be fixed yet.\u003c\/li\u003e\n\u003cli\u003eA \"what was checked\" appendix that states the limits of the scan honestly.\u003c\/li\u003e\n\u003cli\u003eReporting built to CompTIA Security+ and PenTest+ practice standards.\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eWho it's for\u003c\/h3\u003e\u003cp\u003eSolo developers, small product teams, and business owners who had an application built for them and want to know what it depends on. Subscription scanners charge per developer per month; this is one run and a written report.\u003c\/p\u003e\u003ch3\u003eRequirements\u003c\/h3\u003e\u003cul\u003e\n\u003cli\u003eWindows 10 or Windows 11\u003c\/li\u003e\n\u003cli\u003eNo administrator rights needed\u003c\/li\u003e\n\u003cli\u003eAn internet connection, for the vulnerability database lookups\u003c\/li\u003e\n\u003cli\u003eA local folder containing a project you own or are authorised to scan\u003c\/li\u003e\n\u003cli\u003eAbout 5 minutes, longer for a large monorepo\u003c\/li\u003e\n\u003c\/ul\u003e\u003ch3\u003eWhat this is not\u003c\/h3\u003e\u003cp\u003eQuickScan is detection and advisory only. It reads your dependency files; it never uploads your source code, never installs or runs a package, never tests whether a vulnerability is exploitable, and changes nothing in your project. If the vulnerability database cannot be reached, the report says the check did not run rather than reporting a clean result. It is not a certification, an audit or an attestation.\u003c\/p\u003e\u003cp\u003e\u003csmall\u003eOne-time purchase. No subscription, no auto-renewal. Your report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.\u003c\/small\u003e\u003c\/p\u003e","brand":"ThreatVector","offers":[{"title":"Default Title","offer_id":52916779188536,"sku":"DEP-68","price":79.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/1011\/7123\/3080\/files\/card-DEP-68.png?v=1788725722","url":"https:\/\/cybermafia.store\/products\/quickscan-dependency-supply-chain-scan","provider":"ThreatVector","version":"1.0","type":"link"}