Provenance – Software supply-chain security desk

Loading Provenance…

Provenance is a full program that runs in your browser and needs JavaScript. Please enable JavaScript, or use its engine as tools without it:

SBOM Explorer – Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities.
SBOM License Checker – Check SBOM licences: SPDX expressions, copyleft class and conflicts with your project licence.
Dependency Vulnerability Explorer – Known vulnerabilities in your dependencies, and the version that fixes each one.
Container Image Explorer – Inspect a container image: platforms, layers, base image, root user, labels and cosign signature.
Package Ecosystem Graph – Who depends on what: resolved dependency graph, duplicates and the blast radius of breaking changes.
Security Advisory Timeline – Disclosures, affected ranges, fixes and withdrawals for a package on one timeline, with time-to-fix.
Open Source Trust Explorer – Is this open-source project maintained and trustworthy? Scorecard, activity and provenance.
Artifact Provenance Explorer – Verify npm build provenance: Sigstore signature, transparency log, source repo and commit.
CVE Relationship Graph – One CVE or GHSA as a graph: aliases, affected packages, fixed versions, KEV status and EPSS.
Security Configuration Scanner – Passive, graded check of a domain's TLS, security headers, DNS security and security.txt.
OAuth Permission Explorer – What an OAuth consent request really allows: scopes, risky combinations and flow problems.
C2PA Credentials Inspector – Read C2PA Content Credentials in images and videos: actions, AI hints, signer and signature.