All features Supply chain security
Security workflow
Available nowTurn dependency advisories into upgrade decisions.
Winfunc scans supported repository dependency data with osv-scanner, enriches each result from the OSV API, and preserves package, version, severity, affected-range, and reference context. The dashboard turns available fix data into ecosystem-specific upgrade guidance and recommends a rescan when OSV does not name a fixed version.
Supply chain securityAvailable now
01Repository dependencies
02OSV enrichment
03upgrade and rescan
The problem
Security work should end in a decision, not another queue.
A package identifier and severity score are not enough to plan remediation. Teams need to know which repository contains the dependency, what OSV reports, whether a fixed version exists, and how to make and verify the upgrade in the package ecosystem they use.
WorkflowRepository dependencies → OSV enrichment → upgrade and rescan
How it works
From scope to an engineering decision.
Connect an authorized repository with supported dependency files and identify the engineering owners who will assess and apply package upgrades.
- 01Scope
Scan supported repository dependency files with osv-scanner
- 02Investigate
Enrich detected vulnerabilities with current OSV advisory details
- 03Investigate
Review affected versions, severity, references, and available fixes
- 04Review
Apply the ecosystem-specific upgrade path and rescan the repository
Review-ready output
What your team gets.
Affected and fixed-version context
Upgrade guidance with a rescan step
Built for handoff
Evidence your team can inspect.
Keep the reviewed scope, supporting evidence, uncertainty, and next action together so security and engineering can make the same decision from the same context.
Measure the workflow
Track open dependency findings, findings with a named fixed version, upgrade lead time, and the share closed by a clean follow-up scan.
Repository-scoped dependency findings with OSV identifiers and source links
Affected package, installed version, severity, and advisory metadata
Fixed-version guidance when OSV provides it
Package-manager-specific upgrade commands where supported
A clear rescan step to verify the dependency state after remediation
Why it matters
Reduce time spent translating advisory records into concrete, verifiable dependency upgrades.
Scope & limits
Coverage follows osv-scanner and OSV data. It does not prove application logic, build provenance, or runtime exposure is secure.