Maps your real dependency tree
Direct and transitive packages, so a vulnerability three levels deep doesn't hide from you.
Most of your code is other people's code. Nurbak's software composition analysis finds the vulnerable and risky dependencies you pulled in — and, crucially, tells you which ones you actually reach, so you fix what matters. Scan a public repo free.
Direct and transitive packages, so a vulnerability three levels deep doesn't hide from you.
A CVE in a package you never call isn't your emergency. It flags what your code actually reaches first.
Abandoned, typo-squatted or suspicious dependencies — supply-chain risk a CVE list alone misses.
Runs on our own model on ephemeral infra; your code never reaches a third-party AI and isn't stored.
Paste a public repo, or connect a private one read-only.
We resolve your direct and transitive dependencies.
The model checks each for known and likely risk.
You get findings ranked by reachability and impact.
Re-scan after upgrades to confirm the risk is gone.
SCA analyzes the open-source and third-party components in your code to find known vulnerabilities and licensing or supply-chain risk. Nurbak adds reachability so you fix the dependencies your code actually uses first.
A plain scanner lists every CVE in every package, including ones you never call. Nurbak reasons about which dependencies your code actually reaches, so the list is short and actionable.
Scanning a public repository is free with no account. Private repos and continuous monitoring are on paid plans.
No. Analysis runs on our own model on ephemeral infrastructure; your code is deleted after the scan and never reaches OpenAI or Anthropic.
See which of your dependencies are actually putting you at risk in minutes.
Scan my repo