Supply chain security
Every dependency alert is checked against your code: is the package imported, is the vulnerable function called. Confirmed alerts can become fix pull requests, malicious packages are matched every few minutes, and the AI bill of materials lists the models and MCP servers each repository uses.
Chapters
What it covers
- Reachable alerts first
- Fixes as pull requests
- Malicious packages
- AI bill of materials
inline checks each dependency alert against your own code, opens fixes as pull requests, matches malicious packages and lists the AI in each repository.
Read about SecurityTranscript
The narration as spoken, by chapter. Select a time to play the film from there.
Intro
inline, for your supply chain. Fix what your code actually calls, and know what AI your code ships.
Alerts, reachable first
Every dependency alert is checked against your own code. Is the package imported? Is the vulnerable function called? Reachable alerts come first, then unknown, then unreachable. Nothing is hidden.
The evidence
Open one, and the proof is right there: the import, and the call.
Fixes as pull requests
Once an alert is confirmed, inline can open the fix as a pull request, upgrading to the first patched version when there is one. Nothing merges on its own.
Malicious packages
Malicious packages are pulled in every few minutes and matched against every monitored repository. With alerts on, your team hears about it by email, Slack or Teams.
AI bill of materials
The AI bill of materials lists the SDKs, models, MCP servers and prompts in each repository, ready to export as CycloneDX. Every model is listed with the files that name it.
The trust page
And the public trust page shows what inline reads, what it keeps, and who processes it. inline. Fix what your code actually calls.
More films
1:30FleetWhat is really reachable on each machine, and firewall plans a person approves.Watch
1:30Platform dashboardEverything inline does on one page, worst first, narrowed to what each person may read.Watch
1:31The new inline portalOne sidebar, a command palette, a personal inbox and a copilot on every page.Watch
Put it on one repository
Connect GitHub or GitLab, enable a repo, and the next pull request opened gets a review.