Application security starts with the dependencies you use.
Application security teams need to know which software dependencies may put a release at risk. Cevnitra brings your application inventory and dependency vulnerability findings together, so developers can investigate affected versions and prioritize security fixes.
Get started with Cevnitra →Build a software dependency inventory
Start with the packages and versions your application actually uses. Import a supported dependency file or add dependencies manually. An accurate inventory gives a vulnerability assessment a useful starting point: the recorded version, its ecosystem, and the application that depends on it.
- Group dependencies with the applications they belong to.
- Import supported manifests and lockfiles, or enter exact versions.
- Keep the inventory updated when your team changes dependencies.
Scan package versions for known vulnerabilities
Cevnitra checks recorded package versions against OSV advisory data from its private advisory mirror. Review each potential match, including its affected versions and advisory details. An advisory may use a CVE identifier or another ecosystem-specific identifier; review the advisory itself before deciding what action to take.
- Find known dependency vulnerabilities in recorded inventory.
- Review severity and advisory context before prioritizing an upgrade.
- Run another scan after updating the recorded package version.
Move application security findings into remediation
A finding is useful when the engineers responsible for the application can act on it. Configured integrations can send alerts about newly detected scan findings or create Jira issues for selected events and severity levels. Your team investigates, applies the fix, updates the inventory, and scans again to review what remains.
- Route relevant findings through configured Slack, Teams, or webhook integrations.
- Create Jira issues to assign and track remediation work.
- Use a fresh scan to review findings after a version change.
Questions about application security
Is Cevnitra a source-code or penetration-testing scanner?
Cevnitra focuses on known vulnerabilities in recorded software packages and infrastructure versions. It does not analyze source code, crawl a running application for exploits, or perform penetration tests. It can support a wider application security workflow alongside those tools.
Does dependency vulnerability scanning prove my application is exploitable?
No. A version match identifies an advisory to review. Your team should check the affected ranges, usage, configuration, and deployment context before treating a finding as applicable to the application.