Fix the vulnerabilities you actually reach.

That is the part most scanners get wrong. repowise scores known vulnerabilities with KEV and EPSS, then filters them against your real dependency graph so the list narrows to the vulnerabilities your code actually reaches. A CVE in a package you import but never execute is not the same as one on a live code path, and the triage reflects that. Usage-aware CVE triage is generally available on the hosted platform. Function-level reachability triage, which narrows further to the exact functions you call, is on the roadmap.

Your code never leaves your infrastructure. repowise is open source under AGPL-3.0 and fully self-hostable, with a managed hosted platform as an option. Raw source is processed transiently and never persisted. What is stored is the dependency graph, non-reversible embedding vectors, generated wiki pages, and git metadata, not your source files.

Secret detection runs across your full git history, not just the current tree. A key that was committed and later removed is still recoverable from history and still a live exposure, so repowise looks at every commit, not the current checkout alone. Secret detection across full git history is generally available on the hosted platform.

Yes. repowise generates a CycloneDX software bill of materials and produces diffs between versions, so you can see exactly what changed in your dependency set between releases. VEX is supported for communicating which listed vulnerabilities actually affect you. SBOM (CycloneDX) generation and diffs are generally available on the hosted platform.

No. There is no model in the loop in the scanning and scoring path, so results are deterministic, reproducible, and auditable. The same inputs always produce the same findings. Because no AI or ML model sits in the loop, EU AI Act high-risk obligations do not apply to the scanning path.

PCI-DSS and SOC 2 control-coverage reports are generally available on the Teams tier and above: control-by-control coverage derived from your live findings, with evidence drill-ins and JSON/Markdown export. They are not an audit; they are an honest map of where an assessor will look. repowise also generates a CycloneDX SBOM with version diffs and VEX, and there is an audit trail for the security surface on Teams and above.

Generic scanners rank findings by CVSS severity and return everything that matches a manifest, including vulnerabilities in code you never execute. repowise scores with KEV and EPSS and then filters to what you actually reach on the dependency graph, so the list you act on is the list worth acting on. The scanning path is deterministic and the whole thing is self-hostable.

Generally available on the hosted platform: CVE-aware dependency analysis with KEV and EPSS, usage-aware CVE triage, secret detection across full git history, SBOM (CycloneDX) generation and diffs, and PCI-DSS / SOC 2 control-coverage reports on Teams and above. In development: graph-aware enhanced scanning and language-specific security rulesets. On the roadmap: function-level reachability triage.