Open fix PRs and check new ones
Connect
SPIRITT
OSVVulnerabilities found.
Fixes shipped.
SPIRITT checks every dependency in your repositories against OSV, opens fix pull requests, tracks what remains and answers the next advisory with exactly which services are affected.
What you can do with OSV.
Every dependency checked
Thousands of packages and versions checked across repos in one pass.
Full advisory detail
Affected ranges, severity, aliases and references for each finding.
From finding to fix
Upgrades proposed, pull requests opened and progress tracked to zero.
Works with your other apps.
Get started in three steps.
01
Open your workspace
Start a workspace beside your repositories and tracker.
02
Connect OSV
OSV is open data, so SPIRITT can query it right away.
03
Hand over security hygiene
Tell SPIRITT which repos matter; it scans, fixes and reports on schedule.
Hand over a mission.
Choose a mission. Make it yours.
Put OSV to work.
Known vulnerabilities, gone.
Questions
OSV, with SPIRITT.
01What can SPIRITT do with OSV?+
It checks packages, versions, package URLs and commits for known vulnerabilities, including up to 1,000 at a time, retrieves full vulnerability records and helps identify versions of vendored C and C++ libraries.
02Do I need an account?+
No. OSV is an open database, so there is nothing to sign up for.
03Which ecosystems are covered?+
Any ecosystem OSV covers, such as npm, PyPI, Go, Maven, crates.io and more. SPIRITT reads the ecosystem from your lockfiles.
04Does SPIRITT fix the vulnerabilities?+
Yes. It finds the fixed versions from OSV, upgrades the dependency, runs your tests and opens a pull request in your connected repository.
05How does it handle aliases like CVEs?+
OSV records include aliases, so SPIRITT can start from a CVE or GHSA ID and find the matching record.
06How often does it scan?+
On the schedule you set, such as weekly full scans plus checks on every new pull request.