Know which open source risks to fix first, and who fixes them
MergeHarbor keeps an inventory of every repository's dependencies, matches each version against its vulnerability database, ranks findings by severity, exploit activity and reachability from your own code, and routes them to the team that owns them.
golang.org/x/net 0.15.0 · high · CVE-2023-44487
Known exploited (CISA KEV) · EPSS high Reachable: api/server.go calls http2.ConfigureServer (exact)
Owner: @platform-team · SLA: fix within 15 days Fix: upgrade to 0.17.0, the minimal safe version
How it works
Inventory every repository
Lockfiles and manifests are parsed as data on every push and on a schedule. Nothing is installed or run, and no model is called. Repositories without a supported file can import an SBOM.
Rank by real risk
Each finding combines CVSS, EPSS, CISA's known exploited list, whether it is direct or transitive, and reachability: whether your code calls the affected function, from the code graph.
Route, track, fix
Findings go to the owning team with an SLA. Accept a risk with an exception or VEX statement, or open one fix pull request per repository that raises each package to its minimal safe version.
What you get
- Ecosystems
- npm, Yarn and pnpm, Go modules, Pipfile, Poetry and uv, Cargo, RubyGems, Composer, Gradle and NuGet lockfiles, plus Maven, Gradle, .NET and package.json manifests.
- Reachability you can check
- Reachable only when the code graph resolves a call to the affected function as exact or likely. When an advisory names no functions, the finding says unknown rather than guessing.
- SBOM and VEX
- Export CycloneDX 1.6 or SPDX 2.3 JSON for any repository, and import CycloneDX 1.4 to 1.6 or SPDX 2.2 to 2.3 for services MergeHarbor does not index.
- License policies
- Allow, review or deny licenses by SPDX identifier, and see which packages and repositories each policy affects.
- Checked on every pull request
- A pull request that adds or upgrades a package with a known vulnerability or a denied license gets a finding, and the merge gate can block on it.
- Air-gapped ready
- Advisories come from OSV, GitHub, NVD, CISA KEV and EPSS. Self-hosted installs without internet access load offline database bundles.
Frequently asked questions
Does it install or run our dependencies?
No. Dependency files are read as data from the mirror MergeHarbor already holds for indexing. Nothing is installed or executed, and inventories use no credits.
Which plans include it?
Vulnerability management is sold per plan as listed on the pricing page. Searching the public vulnerability database is free for everyone.
Have another question? Ask our support team
Review every pull request with the context of your whole codebase
Connect a code host in minutes. Reviews start right away, and codebase context is added as indexing completes.