Advisories judged against your code
A dependency scanner tells you a package is vulnerable. inline asks the question that matters next: is the vulnerable path reachable from anything you ship? Three tiers of assessment, cheapest first, so triage does not cost what an investigation does.
Confirmed,
or not affected
Every alert is matched to your lockfiles, then assessed against the code that imports it. What comes back confirmed gets a remediation pull request: patched, the suite re-run in a sandbox, and the diff ready to read.
Advisories matched to your lockfiles, then assessed for reachability in your code.
| Package | Severity | Status | Assess cost |
|---|---|---|---|
fast-jwt@3.3.1npmCVE-2026-21841 Signature bypass on ES256 tokens acme/payments-api | critical | confirmed | $0.041 |
Newtonsoft.Json@12.0.3nugetGHSA-5crp Deeply nested payloads exhaust the stack acme/ledger | high | confirmed | $0.038 |
postcss@8.4.31npmCVE-2026-11097 Parser confusion in source maps acme/web | medium | not affected | $0.009 |
tar-fs@2.1.1npmGHSA-pq67 Path traversal when extracting archives acme/mobile | high | open | $0.012 |
urllib3@2.0.6pypiCVE-2026-30820 Redirect leaks the Authorization header acme/etl | medium | dismissed | $0.007 |
feature/inline-fix-cve-2026-21841
Bump fast-jwt to 4.0.2 and pin the ES256 curve
- Reachable from POST /v1/charges
- Patch applied and the suite re-run in a sandbox
- No behavior change outside token verification
Included
More in Security
AI bill of materials
Every AI SDK, model identifier, MCP server and prompt in each repository, with the file and line, rebuilt on each scan and exported as CycloneDX.
Read morePentest
An engagement attacks one repository in an isolated sandbox and reports only the vulnerabilities it exploited, each with a proof of concept and its evidence.
Read more
Related
Fleet
One command enrolls a Linux, macOS or Windows machine. inline maps what can reach each port and proposes firewall plans that roll back unless confirmed.
Read moreAccess control
A module and action permission model where people, coding agents and share links are all principals, each with exactly the access its role grants.
Read moreCompliance
inline finds the providers your code sends data to, reads the agreements you signed, and raises a finding for each provider used without cover.
Read more
Put it on one repository
Connect GitHub or GitLab, enable a repo, and the next pull request opened gets a review.