You can find vulnerable dependencies for free by running a scanner against your lockfile. Use npm audit for Node, pip-audit for Python, OSV-Scanner or Trivy for many languages, or paste a manifest into a browser scanner. Each checks your packages against a public advisory database.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation.
Key takeaways
- A lockfile gives the most accurate result, because it records exact versions.
- Free tools tell you what is vulnerable. They rarely tell you what is exploitable in your code.
- Run a scan in CI so new vulnerabilities fail a build instead of waiting for an audit.
- Treat a clean result as a statement about the advisory database, not a guarantee.
What is the fastest free way to check?
Paste your manifest into the free in-browser scan. It accepts a package.json, a requirements.txt, or an SBOM in CycloneDX or SPDX. The page states that files are parsed in your browser, that nothing leaves it, and that it checks up to 100 dependencies. No login is needed.
How do I scan a Node project?
Run npm audit from the project root. Per the npm docs, it sends a description of your dependencies to your registry and reports known vulnerabilities with remediation advice. By default it needs a package-lock or shrinkwrap file. The audit level setting decides which severity causes a non-zero exit, which is useful in CI.
How do I scan a Python project?
Run pip-audit, a PyPA maintained tool. By default it queries the Python Packaging Advisory Database through the PyPI JSON API, and it can use OSV instead. It audits the current environment, a requirements file, or a project's lock file. It exits with 0 when nothing is found and 1 otherwise.
How do I scan many languages at once?
Use OSV-Scanner or Trivy.
osv-scanner scan -r ./my-project
trivy fs ./my-project
OSV-Scanner reads lockfiles for JavaScript, Python, Go, Java, Rust, Ruby, PHP, .NET and more, and the recursive flag walks subdirectories. Trivy's filesystem scan looks for vulnerabilities from lock files such as package-lock.json and Gemfile.lock.
Does my code host already do this?
Often yes. GitHub's Dependabot alerts scan the default branch and raise an alert when the dependency graph changes or a new advisory is published. Only advisories reviewed by GitHub trigger alerts, and the docs note that new vulnerabilities may take time to appear. The page we fetched does not state a price, so check your plan.
Click through it at your own pace, or open it full screen.
What do free scans miss?
Free scans match versions to advisories, so they have blind spots.
- No view of whether your code calls the vulnerable function.
- Little help with prioritizing among dozens of findings.
- Gaps for packages with no published advisory yet, including newly malicious ones. pip-audit's own page says it does not defend against malicious packages.
The Gold registry at gold.safeguard.sh lists packages, CVEs with CISA KEV status, and malicious packages, which helps you judge which findings to fix first.
Frequently asked questions
Is npm audit enough?
It covers npm packages against your registry's advisory data. It does not cover other languages or tell you whether your code calls the vulnerable function.
Do I need a lockfile?
It is strongly recommended. npm requires one by default, and without it results can differ between runs because npm rebuilds the tree each time.
Are Dependabot alerts free?
The GitHub documentation page we fetched does not state a price. Check your repository plan.
How often should I scan?
On every pull request and on a schedule, because new advisories appear after code ships. A nightly scan catches those.
Does a clean scan mean I am safe?
No. It means no known advisory matched the versions the tool saw.
Sources
- npm audit
- pip-audit
- OSV-Scanner documentation
- OSV-Scanner supported languages and lockfiles
- Trivy filesystem target
- GitHub Docs: About Dependabot alerts
- Safeguard free scan
Last reviewed: 19 October 2026.
