Lockfiles
Parses package-lock.json, requirements.txt, Gemfile.lock and Cargo.lock.
Cybersecurity
SBOM Checker Dependency vulnerability scanner
Send a lockfile or a package list; we match up to 500 packages per request against OSV.
No credit card required · Free API key
- Lockfile formats parsed
- 4
- Packages per request
- 500
- Package ecosystems accepted
- 14
Capabilities
Key features at a glance.
Package lists
Or send name, version and ecosystem for npm, PyPI, Go, Maven, NuGet and more.
Nested dependencies
Lockfiles pin nested dependencies too, so they are checked with the rest.
OSV matching
Each package version is matched against OSV.dev advisories.
Build gates
Results are counted by severity, ready to fail a CI build.
Applications
Use cases to evaluate first.
Development teams
Check dependencies before deploying to production.
Security teams
Audit third-party components in your applications.
DevSecOps
Integrate security checks into CI/CD pipelines.
In depth
Worth knowing before you start.
What an SBOM is
A software bill of materials lists every component and dependency in an application. Log4j (CVE-2021-44228) showed how one nested library can expose thousands of products.
FAQ
Frequently asked questions.
Which files can I send?
package-lock.json, requirements.txt, Gemfile.lock and Cargo.lock, or a list of packages with name, version and ecosystem. SPDX and CycloneDX files are not parsed yet.
How do you identify vulnerabilities?
Each package version is matched against OSV.dev, which aggregates ecosystem advisories such as GitHub Security Advisories and RustSec.
Can I run it in my CI/CD pipeline?
Yes. POST the lockfile to /sbom with your API key and fail the build on the severity counts in the response.
Do you check transitive dependencies?
When the file lists them. package-lock.json, Cargo.lock and Gemfile.lock pin nested dependencies; a requirements.txt covers only what it names.
Explore
Related tools and pages.
Research
Related articles from the research blog.
Blog post
SBOM and Supply Chain Security: What Security Teams Actually Need
Software bills of materials are not paperwork for compliance alone. Learn how SBOMs reduce third-party risk and speed response when a dependency blows up.
Read more
Blog post
Supply Chain CVE Response: SBOMs, Dependency Risk, and Coordinated Vulnerability Disclosure
Build a modern supply-chain security program: generate SBOMs, map CVEs to components, integrate EPSS and KEV, and coordinate fixes across vendors and open-source maintainers.
Read moreTest it with your own indicators.
The free plan includes 50 lookups a month. Check the sources and limits, then connect the API.
No credit card required · Free API key