01 / Triage
Reachability-aware scoring
We don't dump 1,400 vulns at the same severity. Score blends CVE rating, dependency depth and maintainer signal — so you fix what actually matters first.
§01 Software supply-chain triage
Drop a lockfile, get a prioritized risk report and a CycloneDX SBOM in 30 seconds. No account, no CLI, no lockfile ever written to disk.
Drop your lockfile here
or tap to browse — parsed in memory, never written to disk.
package-lock.json · yarn.lock · requirements.txt · go.sum · Pipfile.lock — max 5 MB
| Risk | Package | Version | Ecosystem | Depth | CVEs | Max severity |
|---|
Lockfile parsed in memory · never written to disk · deleted after scoring
§03 How it works
package-lock.json, yarn.lock, requirements.txt, go.sum, Pipfile.lock — sent over HTTPS, parsed in memory, never written to disk.
Each package scored by CVE severity × reachability depth × maintainer activity. Critical and direct dependencies surface at the top — not buried in 1,400 entries.
Download a CycloneDX 1.5 JSON SBOM ready for your EU CRA, FedRAMP or SOC 2 audit — or a CSV triage list to share with the team.
§04 Why DepTriage
We don't dump 1,400 vulns at the same severity. Score blends CVE rating, dependency depth and maintainer signal — so you fix what actually matters first.
Export CycloneDX 1.5 JSON. Designed for the EU Cyber Resilience Act, US EO 14028 and SOC 2 evidence packs — drop it straight in your audit folder.
Your file is parsed in memory and discarded after scoring. No accounts, no logs, no disk writes — just the report.
No CLI to install, no GitHub app to authorize, no enterprise sales call. Paste the lockfile and you have an answer before your coffee cools.
§05 Questions
package-lock.json (npm), yarn.lock, pnpm-lock.yaml, requirements.txt (Python), Pipfile.lock and go.sum.§06 Pricing
Payments processed securely by Stripe. We never store card details.