I built a Python dependency vulnerability scanner that prioritizes by exploit risk — geekwala.com

[sour spear]

@vale cargo share source code also..?

[vale cargo]

@sour spear unfortunately it is not open source but happy to answer any questions

[sour spear]

i dont think posting proprietary projects is allowed here. um how exatly does it work??

[vale cargo]

totally fair question —I read the #rules channel and didn't see anything about requiring open source. if the mods feel differently I'm happy to remove this post!

You were asking How it works: you paste your requirements.txt and it runs it against the OSV database — that's Google's open vulnerability database with 200k+ known CVEs across all major ecosystems
from there it enriches each finding with two extra data points: an EPSS score (a model that predicts likelihood of exploitation in the next 30 days) and a check against the CISA KEV catalog which tracks vulnerabilities that are confirmed to be actively exploited right now
those two signals get combined to surface a short prioritized list rather than dumping everything on you at once — a CVE with a CVSS score of 9.8 that's never been exploited in the wild ranks lower than a CVE with a 7.2 that's on the KEV list
source code stays on your machine, only the package names and versions are sent for scanning

one more thing worth mentioning — the free tier covers most individual projects (5 projects, 50 scans/month, no credit card). but if you're working on something community-driven or open source and need more, reach out and I'm happy to set you up with full access at no cost. no formal process, just message me.

[sour spear]

doesnt owasp zap do the same thing 🤔

[warped holly]

@vale cargo There are post guidelines when creating a post. All projects here must share their source code. Your post will be removed