Security Insights & Guides
Cut through vulnerability noise. Practical guides for dev teams who ship.
Check package.json for Vulnerabilities Online
You don't need to install npm audit or any CLI to check package.json for vulnerabilities. Paste the file, get CVSS, EPSS, and CISA KEV signals on every finding, and see exactly which packages need patching first.
Scan requirements.txt for Vulnerabilities Online
Check a Python requirements.txt, Pipfile.lock, or poetry.lock file for known vulnerabilities without installing pip-audit. Paste the file, get EPSS and CISA KEV signals, and see the exploitation context pip-audit's output doesn't include.
DORA ICT Third-Party Risk & Open-Source Dependencies
DORA's ICT risk-management and third-party-risk articles don't mention open-source dependencies by name, but they cover them. This guide translates Articles 6, 28, and 30 into a concrete scanning baseline: inventory, SBOM, exploitability triage, and reporting.
NIS2 Supply Chain Security Requirements Explained
NIS2 Article 21 requires essential and important entities to secure their supply chain, including software dependencies. This guide translates Article 21(2)(d) and (e) into concrete evidence: SBOMs, scan cadence, and vulnerability-handling records.
EU CRA Day One: Your First 24 Hours
Most CRA coverage is written for the person deciding whether the regulation applies. This is for the engineer who gets paged at 09:14 with 24 hours on the clock: the three deadlines, a ready-to-use early-warning template, and the mistakes that blow the window.
Dependency License Compliance Guide
License compliance is the other reason organizations buy SCA, alongside vulnerabilities. This guide covers permissive vs copyleft licenses, the AGPL network clause every SaaS team should know, and how to audit what your dependency tree actually licenses you to do.
EU CRA CE Marking: The December 11, 2027 Deadline
September 2026 is the CRA's reporting deadline. December 11, 2027 is the bigger one: mandatory CE marking, essential cybersecurity requirements, and formal conformity assessment for every in-scope product. What changes, which tier your product falls into, and how to prepare.
Reachability vs EPSS: Cutting False Positives
Two scanners, same repo, two different finding counts. Neither is wrong. Reachability asks whether your code calls the vulnerable function. EPSS asks whether anyone will exploit it. How they compare, where each fails, and how to combine them without discarding the KEV signal that matters most.
Software Composition Analysis Tools (2026)
Software composition analysis buyers evaluate a shortlist, not a single product. Here's a neutral, sourced comparison of 10 SCA tools — vulnerability detection, license compliance, and reachability — including where GeekWala fits and where it doesn't.
Manifests vs Lockfiles Explained
A manifest declares what you want; a lockfile records what you got. This explainer defines manifest, lockfile, dependency graph, direct and transitive dependency, and semantic versioning — the mechanics every dependency vulnerability scanner relies on.
GitHub Code Security Pricing Explained
GitHub split Advanced Security into two per-committer SKUs. Here's what Code Security and Secret Protection actually cost at real team sizes, and how GeekWala's flat pricing compares for dependency scanning specifically.
Trivy vs Grype: Open-Source Scanner Comparison
Trivy (Aqua Security) and Grype (Anchore) are the two most-adopted open-source vulnerability scanners for containers and dependencies. Here's how they actually differ — no vendor picked.