Scope
What it checks, and what it doesn't
A score is only useful if you know what went into it. This scanner answers one question well: do this repository's dependencies have known vulnerabilities?
Checks
Known vulnerabilities in dependencies
Every dependency version is looked up in OSV.dev. Findings include the CVE (or advisory) ID, severity and the first fixed version.
npm, PyPI, Go and Rust
Reads package-lock.json or pnpm-lock.yaml (falling back to package.json), requirements.txt, go.mod and Cargo.lock.
Two security practices
Whether the repo has a SECURITY.md policy and a Dependabot configuration.
Doesn't check
Your own source code: no injection, XSS or authentication analysis (that's static analysis, a different tool)
Compliance: nothing here assesses GDPR, SOC 2 or HIPAA
Test coverage, CI setup or code quality
Other manifest formats, such as yarn.lock or poetry.lock (not parsed yet)
How it works
Five workflow steps, all visible in the builder
The findings come from OSV.dev and the score from a fixed formula. The AI step only writes the explanation. It can't add, remove or re-grade findings.
- 1
Parse Repository
Turns the URL you typed into owner/repo.
- 2
Fetch Repo Metadata
Stars, language and default branch from the GitHub API.
- 3
Security Scan
Reads the manifests from GitHub, queries OSV.dev, and scores the result with the formula below.
- 4
Calculate Score
Prepares the score, grade and breakdown for the report. No AI involved.
- 5
Write the report
Built from the scan data; or, if you switch it on, an LLM with your own key explains the findings.
Why the AI doesn't get to decide: The Untrusted Reasoning Worker.
Scoring
How the score is calculated
A weighted average of four parts, rounded to 0–100. Grades: A+ from 95, A from 90, A− from 85, B+ from 80, B from 70, C+ from 60, C from 50, D below that.
- 35%Vulnerabilities
100, minus 30 per critical, 20 per high, 10 per medium, 2 per low
- 25%Affected packages
100, minus 15 per dependency with any known vulnerability
- 25%Practices
50 each for SECURITY.md and a Dependabot config
- 15%OWASP A06
Pass 100 · medium findings only 70 · any high or critical 30
Source: lib/osv/scanner.ts
Before you run it
Sample results, real scans, and your data
Sample results (default)
Without any setup, runs return bundled sample data so you can see the whole workflow. A few well-known repos have their own samples; other repos show a generic one. Sample scores are not a real assessment.
Real scan
Turn on Run a real scan in the run dialog. Public repos work without a key, but GitHub's unauthenticated rate limit is low; a GitHub token raises it and allows private repos.
AI-written report (optional)
Off by default, even if you've saved AI keys. Turn on Write the report with my AI key for a run to have an LLM, using your own key and quota, explain the findings. It can't change them. With a Google key it also draws an illustration, labeled as AI-generated.
What goes where, and who pays
Our server receives the repo name and, if you add one, your GitHub token for that request. It calls the GitHub API and OSV.dev (free), and stores neither the results nor your token. Nothing calls an AI provider unless you switch the AI report on.
Open the workflow, then make it yours
The scanner is an ordinary TopFlow template. Inspect every node, or export it as TypeScript and run and change it on your own infrastructure.