Loading…
How it works
Connect GitHub and Proveta ranks what's vulnerable across your repos. Open fix PRs where it can, and keep a record your customers and auditors can check.
Start free with GitHub01 · Find
Sign in with GitHub and install the Proveta GitHub App on the repos you pick, public or private. You can change the selection in GitHub later.
Proveta brings in your Dependabot alerts and scans each repo's dependencies. Run a scan from Scans, upload a resolved dependency file, or have an admin turn on automatic scans, which check every dependency change on the default branch and recheck for new advisories daily.
Everything lands in one list, ranked by priority. Open a finding to see the advisory, the affected versions, the project path, and the fixed version when there is one.
When Dependabot and a Proveta scan report the same vulnerability, they share one finding, so its owner and decisions stay put.
02 · Fix
Request a fix from a finding. Proveta updates the dependency and opens a pull request, or tells you why it couldn't.
Fix PRs are optional. An admin turns them on and connects a separate GitHub App. Updates can include a major version, and Proveta never runs your tests or merges for you.
03 · Prove
Give each finding an owner, a deadline, and a decision with a reason. Changing a decision adds to the history instead of replacing it.
Invite your team as admins, members, or viewers. Deadlines by severity show what's overdue, and missed deadlines stay on record.
When a customer or an auditor asks, pick the dates in Reports and export the history. It shows which accepted risks were active or expired and keeps the names recorded at the time.
Compare report and team featuresQuestions
Support depends on the package manager, the dependency files, and the project layout. A dependency that can be scanned may still need a manual update.
Uploads accept one resolved dependency file, up to 3 MiB, associated with a connected repository and its original file path. A package.json, go.mod, or requirements.txt alone is not a resolved upload.
Repository scans can also resolve supported standalone manifests when a qualified resolver is enabled. They use the default-branch snapshot and public package registries. Results describe the scanned files and environment, including any unresolved dependencies or unsupported layouts. The scanner checks known dependency vulnerabilities; it does not analyze application code for new security bugs.
Fix PRs require an eligible open or triaged finding, a verified fixed version, access to the repository, and a supported dependency layout. Available managers depend on the enabled fix worker.
Supported layouts cover npm, Yarn Classic, pnpm, Go modules, exactly pinned pip requirements, Maven, NuGet, Bundler, Composer, and Cargo. Each fix is limited to one dependency directory. JavaScript projects need their package.json and one supported lockfile.
Private package registries, linked workspaces, Yarn Berry/PnP, Gradle, Poetry, and uv are outside the current fix workflow. npm-shrinkwrap.json can be scanned, but is not supported for fix PRs. A patch may still need manual work when the required update falls outside these limits.
Yes. Keep it connected alongside Proveta scans. Matching observations share a finding, and a complete Proveta scan does not close a vulnerability that Dependabot still reports. Dependabot coverage and scan coverage remain visible separately.
When no source reports the vulnerability anymore. Opening or merging a fix PR doesn't close it by itself, and a scan can't confirm that a fix reached your production deployment.
No. It means the scanned files had no known dependency vulnerabilities at that time. A partial scan shows its gaps, and the scan history shows what was checked and when.
No. The records help you answer customer questions and security reviews. They don't replace your wider security process or establish compliance on their own.
GitHub access
The Proveta GitHub App reads Dependabot alerts and repository information. Repository scans need Contents read permission to fetch a snapshot, which can contain source code. Existing installations may need to approve this permission.
An upload checks the file you provide without fetching a repository snapshot. It still belongs to a connected repository so its findings can share the same owners and decisions.
A separate GitHub App can read and write repository contents and pull requests to prepare a proposed fix. A workspace admin enables this connection. Your team reviews and merges in GitHub.
Connect 1 repo for free. Scan its dependencies and give the first finding a next step.
