Free tool

Scan a mobile app for the CRA.

Drop a lockfile to get a CycloneDX software bill of materials and a list of known vulnerabilities in its components. It takes a few seconds and needs no account.

App name (optional, used in the SBOM)

Drop a lockfile here, or choose a file pubspec.lock · package-lock.json · yarn.lock · Podfile.lock · Package.resolved · gradle.lockfile

Your file is read in your browser and is never uploaded. Only package names and versions are sent to OSV.dev to look up vulnerabilities. Nothing is stored.

Where to find the lockfile

Flutter: pubspec.lock in the project root.
React Native: package-lock.json or yarn.lock in the project root. Add ios/Podfile.lock for the native iOS side.
iOS: Podfile.lock, or Package.resolved inside your .xcodeproj or .xcworkspace under project.xcworkspace/xcshareddata/swiftpm/.
Android: gradle.lockfile. If you do not have one yet, run ./gradlew dependencies --write-locks after enabling dependency locking.

This scan is a starting point, not a conformity assessment. It shows the components a single lockfile declares and the vulnerabilities publicly known for them today.