Skip to main content
Most dependency scanning tells you what was vulnerable the last time you scanned. A vulnerability disclosed an hour ago does not wait for your next scan. Dependency risk is really two questions, and they need different answers.
  • Are we exposed right now? Answered by the dependency map.
  • Has something new just been disclosed? Answered by an hourly check.

​
The inventory

Amnify keeps a resolved dependency inventory per repository: the ecosystem, package and installed version for direct and transitive dependencies. It refreshes on a push to your default branch, on the hourly check, and on demand from Scan automation.

​
Hourly monitoring

The inventory is checked hourly against public advisories. When something new affects a version you actually run, an agent is dispatched straight away to work out how exposed you actually are. Every check is recorded with its outcome and what triggered it, so the history shows both what was found and what was looked at.
Hourly monitoring is free. A dependency check only runs when an advisory actually affects a version you run.

​
Reachability decides the urgency, not whether it is reported

A vulnerability in a package you depend on is not automatically a vulnerability in your application. An agent traces whether the affected function is actually called from your code. Either way you get a finding. What changes is what arrives with it. Nothing is dropped for being unreachable. It becomes reachable the moment someone calls that function, so it stays on the record and in your dependency map, just without demanding your attention today.

​
What a dependency finding carries

  • The package, ecosystem and installed version.
  • The advisories against it, linked to the public record.
  • Why it is newly relevant: newly added to your inventory, or newly disclosed.
  • Whether your code reaches the vulnerable path, which is what decides whether a pull request comes with it.
  • The upgrade that resolves it.

​
Dependency map

The current answer to “are we exposed right now?”. Per repository, how many tracked dependencies have a published advisory against the exact version in use, split by ecosystem. Open a package to see its advisories, each linked to the finding raised for it.

​
Check history

The audit answer to “what did you check, and when?”. Grouped by repository, newest first, each row reading as one of four outcomes. A row that found something expands to list the affected dependencies with their advisories, and why each is newly relevant.

​
In a penetration test

A white box penetration test independently confirms that a vulnerable version is actually present before reporting it. See How a pentest runs.