SCA / Dependency Tracker

Know exactly which packages put you at risk

Pragma Core scans every dependency in every repository against a comprehensive vulnerability database. You get real-time alerts on vulnerable packages, clear upgrade paths, and a single view across your entire software supply chain.

Start tracking dependencies View all features

How it works

From lockfile to actionable risk report

The platform parses your dependency manifests, checks every package against known vulnerability data, and surfaces issues with everything you need to act.

Parse dependency files

Lockfiles and manifests are detected automatically across npm, Composer, pip, Maven, Go, NuGet, RubyGems, Cargo, and more.

Check vulnerability data

Each package and version is checked against known CVEs and security advisories to identify vulnerable dependencies.

Surface actionable findings

Vulnerable packages appear with severity, CVSS scores, affected version ranges, and the specific version that fixes the issue.

Monitor continuously

New advisories are checked on every sync. A package that was safe yesterday gets flagged the moment a new CVE is published.

Live look

A snapshot of one workspace

A real engineering org has dependencies in several ecosystems and a long tail of CVE alerts at any given moment. Here is what the dashboard view collapses that into.

Vulnerable packages by ecosystem

Sample workspace

Counts pulled across every repository in a single workspace, grouped by package manager. Hover any bar to see how the severity mix breaks down.

Top advisories surfaced

Latest 5

Ranked by CVSS, with a clear fix path. The "in repos" column tells you how many repositories pull in the same vulnerable version, which is usually the first question that comes up in triage.

Package	Severity	CVE	Fixed in	In repos
[email protected]	9.8	CVE-2021-23337	4.17.21	7
[email protected]	8.6	CVE-2023-31047	3.2.19	3
[email protected]	10.0	CVE-2021-44228	2.17.1	2
[email protected]	5.6	CVE-2022-24785	2.29.4	9
[email protected]	7.5	CVE-2022-0778	1.1.1n	4

Capabilities

Complete supply chain visibility

Multi-ecosystem support

npm, Composer, pip, Maven, Go modules, NuGet, RubyGems, Cargo, pub, and CocoaPods. One scanner covers your full stack regardless of which languages your teams use.

CVSS scoring and severity

Every advisory includes severity classification and CVSS scores pulled directly from the vulnerability database, so your team can prioritize the most critical upgrades first.

Fix version guidance

For each vulnerable package, the platform shows which version resolves the issue. No guesswork about whether upgrading from 2.3.1 to 2.3.4 actually patches the CVE.

Cross-repository view

See which repositories share the same vulnerable package. When a single library affects five repos, you want to know that before you start patching.

Vulnerability lifecycle

Mark advisories as open, acknowledged, fixed, or false positive. Track triage decisions over time and maintain an audit trail for compliance reviews.

Continuous monitoring

Dependencies are re-checked every time the repository syncs. New CVEs published against packages you already use are flagged automatically, with no manual re-scans required.

Why it matters

Most breaches start with a known vulnerability in a dependency

Reduce your attack surface automatically

You cannot patch what you do not know about. SCA gives you a clear inventory of every third-party package, version, and known weakness across all your projects.

Stay ahead of new disclosures

The vulnerability database is checked on every sync. When a new CVE is published against a package in your lockfile, it shows up in your dashboard the same day.

Simplify audit preparation

Auditors ask for evidence that you track and remediate known vulnerabilities. The dependency tracker gives you a time-stamped record of findings, triage decisions, and resolutions.

Consistent process across every team

Whether your backend runs on Go and your frontend on TypeScript, the same workflow applies. One dashboard, one triage process, one set of policies for every ecosystem.

Start tracking your dependencies today

Connect your repositories and get instant visibility into every vulnerable package across your stack.

Create free account Sign in

Have questions? Get in touch →