Package & dependency vulnerability audit
Which of your packages are vulnerable, and exactly what to upgrade.
Drop in a lockfile or run a one-line agent on a server. PatchPilot checks every package against OSV.dev, the open vulnerability database behind GitHub, PyPI, Go and the Linux distributions, then hands you a single upgrade command.
Try a sample requirements.txt. Files are only used for this audit.
What PatchPilot checks
12 formats
package-lock.json, yarn.lock, composer.lock, requirements.txt, Pipfile.lock, Gemfile.lock, Cargo.lock, go.sum, go.mod, dpkg -l, rpm -qa.
Linux servers
A 20-line shell agent sends only package names and versions from Debian, Ubuntu, AlmaLinux, Rocky and Alpine.
Fix plan
For each package: how many vulnerabilities, the worst one, and the lowest version that fixes them all.
One command
A ready npm, pip, composer, bundle, cargo, go, apt, dnf or apk command for the whole fix.
No duplicates
The same CVE published by GitHub, PyPA and the distro is shown once, with the best score.
Exploited first
CVEs on the CISA Known Exploited list are raised to at least high and shown first.
Like Dependabot or Snyk, without connecting your code repository. Works for servers too, which they do not cover.
Three steps
- Upload a lockfile, or run
curl -fsSL https://fullstackpartner.com/patchpilot/agent.sh | PATCHPILOT_KEY=… shon a server. - Read the fix plan: packages ranked by worst vulnerability with the version that fixes them.
- Run one command, upload again, and watch the grade go to A.
Pricing
Business
490 kr/month
- 25 assets, daily scheduled scans
- Deep scans and leaked-file probing
- Unlimited PatchPilot agents
- "New since last scan" alerts
Partner
1.990 kr/month
- Unlimited assets for your clients
- White-label PDF reports
- API access
- Help fixing findings from fullstackpartner.com
Planned prices. Payments are not switched on yet, so everything is free while we are in beta.
Our scanning rules
Port scans and deep website scans only run against assets you have proved you control, with a DNS TXT record or a file on the server. Every scan identifies itself as FSP-Security-Scanner, comes from one published IP, never tries to log in or exploit anything, and refuses private and internal addresses. Quick SiteSentry scans only read what any browser can see.