> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amnify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Dependencies and CVE disclosures

> Known vulnerabilities in what you actually run, monitored hourly against newly published advisories.

Most dependency scanning tells you what was vulnerable the last time you scanned. A vulnerability disclosed an hour ago does not wait for your next scan.

Dependency risk is really two questions, and they need different answers.

* **Are we exposed right now?** Answered by the dependency map.
* **Has something new just been disclosed?** Answered by an hourly check.

```mermaid theme={null}
flowchart TB
  S["Dependency inventory<br/>per repository"] --> C{"Hourly check against<br/>public advisories"}
  C -->|"nothing new"| N["Recorded as clean"]
  C -->|"affects a version<br/>you run"| Q["Agent dispatched"]
  Q --> R{"Reachable from<br/>your code?"}
  R -->|"reachable"| F["Finding, with a fix<br/>and a pull request"]
  R -->|"not reachable"| G["Finding, no pull request.<br/>You decide when to fix it"]
```

## The inventory

Amnify keeps a resolved dependency inventory per repository: the ecosystem, package and installed version for direct and transitive dependencies. It refreshes on a push to your default branch, on the hourly check, and on demand from [Scan automation](/scanning/automation).

## Hourly monitoring

The inventory is checked hourly against public advisories. When something new affects a version you actually run, an agent is dispatched straight away to work out how exposed you actually are.

Every check is recorded with its outcome and what triggered it, so the history shows both what was found and what was looked at.

<Tip>
  Hourly monitoring is free. A dependency check only runs when an advisory actually affects a version you run.
</Tip>

## Reachability decides the urgency, not whether it is reported

A vulnerability in a package you depend on is not automatically a vulnerability in your application. An agent traces whether the affected function is actually called from your code.

Either way you get a finding. What changes is what arrives with it.

| Result            | What you get                                                                                    |
| ----------------- | ----------------------------------------------------------------------------------------------- |
| **Reachable**     | A finding **with a remediation plan and a pull request**, ready to review. This is today's work |
| **Not reachable** | A finding **with no pull request**. Recorded and tracked, yours to schedule when it suits you   |

Nothing is dropped for being unreachable. It becomes reachable the moment someone calls that function, so it stays on the record and in your dependency map, just without demanding your attention today.

## What a dependency finding carries

* The package, ecosystem and installed version.
* The advisories against it, linked to the public record.
* Why it is newly relevant: newly added to your inventory, or newly disclosed.
* Whether your code reaches the vulnerable path, which is what decides whether a pull request comes with it.
* The upgrade that resolves it.

## Dependency map

The current answer to "are we exposed right now?". Per repository, how many tracked dependencies have a published advisory against the exact version in use, split by ecosystem. Open a package to see its advisories, each linked to the finding raised for it.

## Check history

The audit answer to "what did you check, and when?". Grouped by repository, newest first, each row reading as one of four outcomes.

| Outcome                | Meaning                                                                         |
| ---------------------- | ------------------------------------------------------------------------------- |
| **Scan started**       | An advisory triggered a dependency check. Links to the run                      |
| **No new scan needed** | Covered by a check already running or queued                                    |
| **No related CVE**     | Checked, nothing affecting you                                                  |
| **Not checked**        | The inventory is empty, the dependency graph is off, or the check could not run |

A row that found something expands to list the affected dependencies with their advisories, and why each is newly relevant.

## In a penetration test

A white box penetration test independently confirms that a vulnerable version is actually present before reporting it. See [How a pentest runs](/pentest/how-it-works).