# Depmoor (by CyberMax)
> Dependency vulnerability scanner ranked by real-world risk. Drop a lockfile and get every known vulnerable package (OSV.dev advisories), ranked by CISA KEV (exploited in the wild) and FIRST EPSS (probability of exploitation in 30 days), with the version that fixes it and one upgrade list per package. Lockfiles are read in the browser.

- App: https://depmoor.cybermax-tools.workers.dev/
- Lockfiles: package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt (pinned), poetry.lock, uv.lock, Pipfile.lock, Cargo.lock, go.sum, composer.lock, Gemfile.lock, gradle.lockfile, packages.lock.json
- Free: 5 scans a day, every finding shown. No account.
- Pro monthly: $9 https://depmoor.cybermax-tools.workers.dev/buy/pro-monthly?s=llms
- Pro yearly: $90 https://depmoor.cybermax-tools.workers.dev/buy/pro-yearly?s=llms
- Team monthly: $29 https://depmoor.cybermax-tools.workers.dev/buy/team-monthly?s=llms
- CI API (Pro 100/day, Team 2000/day): POST https://depmoor.cybermax-tools.workers.dev/api/scan?format=json|sarif|csv|md&fail_on=fix-now with "Authorization: Bearer <key>" and JSON {"filename":"package-lock.json","lockfile":"..."}
- CISA KEV as compact JSON with CORS: https://depmoor.cybermax-tools.workers.dev/api/kev
- Machine-readable pricing: https://depmoor.cybermax-tools.workers.dev/pricing.json