Understand Dependency Risks
in Your Open Source Stack

Enrich scanned components with vulnerability data, available CVSS scores, and known fix versions. Track review decisions and see a reminder when a component’s deferral period ends.

Classify detected SPDX license identifiers against your license policy, review obligations and potential conflicts, and export NOTICE files or SPDX SBOMs for each scan.

Track your security posture across scans. Visualize critical, high, medium, and low severity trends over time, with optional AI-generated deviation insights when an LLM provider is configured.

Trace direct and transitive dependencies when supported lock files or graph data provide paths. Coverage depends on the ecosystem and input; a manifest alone may not contain the complete dependency graph.

Connect supported GitHub, GitLab, or Bitbucket credentials, or import a public repository URL. Queue repository imports, cancel active jobs, and retain branch information and scan history for each project.

Submit scans from local projects or CI. The CLI uploads selected dependency manifests and build files for server-side parsing, then submits components with a project-scoped API key and the submitting user’s credentials.

Export a CycloneDX 1.6 SBOM, a VEX document carrying your triage decisions, or a SARIF report for code-scanning dashboards. Import third-party CycloneDX files to scan components you don’t build yourself.

Evaluate scan results against severity, license, and KEV policies. Use a baseline to assess newly introduced findings when needed. CI integrations can publish GitHub checks and PR comments, and Jira integration links findings to issues.

Review vulnerability and license totals across projects, including unaddressed KEV-listed findings. Projects are ranked by severity counts. Organization and team membership control access; audit logs can be exported separately.

Run local inference with a separately installed llama.cpp runtime. Qwen3.5-2B Q4_K_M is the default download; Gemma 4 E2B is an optional manual installation. CPU-only defaults require no cloud API key. Prepare the runtime and model in advance for offline use.

Import checksummed OSV, deps.dev, EPSS, and KEV snapshot bundles for offline data lookups. Export a wanted list to target the next bundle and check its data freshness. Configure repository, email, webhook, and AI connections separately for an isolated deployment.

Create version-bump PRs or MRs for supported manifests in connected GitHub, GitLab, and Bitbucket repositories. Batch actions attempt one PR per eligible component and report individual outcomes. Repository permissions and a supported version edit are required; reviewer assignment depends on the provider.

Flag suspicious package-name similarities and dependency-confusion patterns for review. These heuristics do not prove an attack or establish package provenance. Confirmed malware advisories are tracked separately and can fail the security gate.

Configure OIDC or SAML 2.0 single sign-on and SCIM 2.0 provisioning. Map identity-provider users to OsWL accounts and manage group assignments. Integration setup and account provisioning are required; OsWL roles and project access still apply.

Inspect Java bytecode references and supported Python or JavaScript source imports when the corresponding inputs are provided. Evidence and coverage help explain findings. A reference does not prove execution, and incomplete analysis remains unknown.

Inspect collected Quick Import files for secret patterns and infrastructure configuration issues. Review locations and rules alongside vulnerability findings. Coverage depends on collected files and enabled scanners; full source checkout is a separate option.