Advisories judged against your code
A dependency scanner tells you a package is vulnerable. inline asks the question that matters next: is the vulnerable path reachable from anything you ship? Three tiers of assessment, cheapest first, so triage does not cost what an investigation does.
Confirmed,
or not affected
Every alert is matched to your lockfiles, then assessed against the code that imports it. What comes back confirmed gets a remediation pull request: patched, the suite re-run in a sandbox, and the diff ready to read.
Advisories matched to your lockfiles, then assessed for reachability in your code.
| Package | Severity | Status | Assess cost |
|---|---|---|---|
fast-jwt@3.3.1npmCVE-2026-21841 Signature bypass on ES256 tokens acme/payments-api | critical | confirmed | $0.041 |
Newtonsoft.Json@12.0.3nugetGHSA-5crp Deeply nested payloads exhaust the stack acme/ledger | high | confirmed | $0.038 |
postcss@8.4.31npmCVE-2026-11097 Parser confusion in source maps acme/web | medium | not affected | $0.009 |
tar-fs@2.1.1npmGHSA-pq67 Path traversal when extracting archives acme/mobile | high | open | $0.012 |
urllib3@2.0.6pypiCVE-2026-30820 Redirect leaks the Authorization header acme/etl | medium | dismissed | $0.007 |
feature/inline-fix-cve-2026-21841
Bump fast-jwt to 4.0.2 and pin the ES256 curve
- Reachable from POST /v1/charges
- Patch applied and the suite re-run in a sandbox
- No behavior change outside token verification
And a red team
that proves it
An opt-in offensive run maps your attack surface from the code and the graph, fans out one agent per attack class, then validates the promising leads by building a non-destructive proof in a sandbox. Only what it proved is reported.
4
23
$3.14
Included
Put it on one repository
Connect GitHub, enable a repo, and the next pull request opened gets a review.