Dependency / SBOM Risk Checker
Paste a dependency list and flag ones matching a known-vulnerable version range.
Most of the code in a modern application was written by strangers and pulled in automatically. A software bill of materials is the inventory of those strangers, and it is the difference between answering "are we affected?" in minutes or in weeks.
How to use it
- Paste dependencies one per line as name@version.
- Review the risk notes returned for each.
What to take away
Transitive dependencies are where the risk hides
You install twenty packages and get eight hundred. The vulnerable one is almost never a package you chose deliberately.
Pin versions, then update them deliberately
Unpinned ranges mean your build is not reproducible and a compromised release can arrive without any change on your side.
Reachability changes severity
A critical CVE in a code path your application never calls is real but not urgent. Deciding that honestly is what stops alert fatigue.
Frequently asked questions
What is an SBOM?
A machine-readable list of every component in your software, with versions and often licences. SPDX and CycloneDX are the two common formats, and both are increasingly required by procurement.
Why did Log4Shell matter so much?
Because a critical flaw sat in a library embedded so deeply and so widely that most organisations genuinely could not tell whether they used it. That inability to answer was the crisis, more than the bug.
Is this a real vulnerability scanner?
No — it is a teaching aid using a small illustrative dataset. Real work uses live advisory feeds through tools like Dependabot, Trivy, Grype or Snyk.
Where this fits in the course
This security tool pairs with Path 22 — DevSecOps & AppSec — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Secure Code Review Toy — Paste a code snippet and get flagged patterns — eval, string-built SQL, hardcoded secrets. Not a real SAST tool, but trains the eye.
- CVSS 4.0 + 3.1 Calculator — Build a CVSS vector and calculate Base, Threat, and Environmental severity locally.
- Leaked Secret Hunt — A public GitHub repo dump. Find the hardcoded API key an automated scanner would catch in minutes — before an attacker does.
- Risk Register Builder — Add risks with likelihood and impact, get an auto-scored severity, and export the register as Markdown.