- Is Pobyte really free?
- Yes. Pobyte is completely free to use, requires no signup, and has no paywall for normal lookups.
- Where does the vulnerability data come from?
- Every lookup queries several public databases in parallel — OSV.dev (which aggregates GitHub Advisories, NVD/CVE records and ecosystem feeds), the GitHub Advisory Database and deps.dev — and labels which source produced each record.
- Which ecosystems can I check?
- npm, PyPI, Maven, Go, RubyGems and crates.io. Generic mode searches across all indexed ecosystems.
- Can I check an entire package.json?
- Yes. Upload a package.json and Pobyte parses its dependencies field in your browser, then lets you query any dependency with one click.
- What does the minimum fixed version mean?
- It is the lowest release that contains the patch for a vulnerability. To fix every finding at once, upgrade to the highest fixed version across the results — Pobyte calculates that target for you.
- Does Pobyte store my queries or my package.json?
- No. There is no database, no login and no server-side history. The file is parsed entirely in your browser, and package names are only used for the live lookup request.
No paywall, no signup and no database. Lookups query public vulnerability data in real time, and package.json parsing happens entirely in your browser.
Check a package