Block one hour, mirror or clone your repositories, and run six searches: lockfiles, git URL dependencies, CI installs, container images, AI usage and agent config files. Write each result to one sheet with an owner column. You will not finish the cleanup in an hour, but you will have a real list.
Before the hour
Get these ready the day before, or you will spend the hour on setup:
- A local mirror or clone of every repo you can read, or a code search tool that covers them.
- Your approved list, even if it is rough.
- A blank sheet with columns for repo, finding, type, owner and action.
- Read access to your source host's app and webhook settings, if you plan to include them.
The timed plan
| Minutes | Task | Guide |
|---|---|---|
| 0 to 10 | List lockfiles and extract packages | find unapproved dependencies |
| 10 to 20 | Search for git URL, tarball and path dependencies | git URL dependencies |
| 20 to 30 | Search CI files and Dockerfiles for installs and images | CI installs, registries |
| 30 to 40 | Search for AI libraries, hostnames and model files | AI services, model files |
| 40 to 50 | Search for agent config files | agent config |
| 50 to 60 | Sort, assign owners, pick the top five actions | This post |
Stick to the clock. A rough sheet today beats a perfect sheet next month.
What to do with each result
Do not fix anything during the hour. Fixing changes the evidence and eats time. Record what you see:
- Repo and file path.
- What it is, in a few words.
- Whether it is on the approved list.
- Who the repo owner appears to be.
If the owner is unclear, write "unknown". An unknown owner is a finding too. See how to find repositories that nobody owns.
The last ten minutes
Sort the sheet by how many repos each finding appears in. Pick the top five. For each, choose the action: approve it, replace it, remove it, or ask the owner. Then send those five to the right people the same day, each with a date.
Capture the three numbers you will compare next time: total packages found, how many were off the list, and how many findings had no owner. The next sweep will show whether they moved. See how to measure your shadow dependency rate.
After the hour
Pick a date for the next sweep. Then automate what you can, starting with the lockfile comparison on pull requests, so the sweep gets shorter each time.
Try it yourself
Open the dependency inventory demo and compare what a single project looks like as a flat list. Imagine the hour's first search producing the same view for every repo.
Click through it at your own pace, or open it full screen.
Quick check
What if we have hundreds of repos?
Start with the repos that deploy to production, or with a sample of ten, and widen from there. A partial list is still useful.
Do we need special tools?
No. Git, a shell and a sheet will get you through the first sweep. Tools help when you repeat it.
Safeguard offers asset discovery, SBOM and dependency scanning, and a free scan at gold.safeguard.sh/scan if you would rather start from a scan.
Last reviewed: 19 October 2026.
