You can scan requirements.txt, Pipfile.lock, or poetry.lock for vulnerabilities online without installing pip-audit or any CLI: paste the file into a browser-based scanner and it checks the listed packages against known CVE databases in seconds. Pinned versions match exactly; unpinned entries need an exact version first. A good scanner adds EPSS and CISA KEV signals, so you see which findings need action now.
Searching "scan requirements.txt for vulnerabilities online" mostly surfaces pip-audit and Safety documentation — genuinely good tools, but both assume you're ready to install a package and run a command before you've confirmed there's anything worth checking. If you just inherited a Python project, are reviewing a dependency before approving a PR, or want a fast answer without touching your environment, you don't need to install anything. This guide covers requirements.txt, Pipfile.lock, and poetry.lock — all three formats scan the same way.
How to Paste-and-Scan requirements.txt, Pipfile.lock, or poetry.lock
Paste the contents of any of the three Python dependency files into a browser-based scanner and it parses the package list, reads the exact versions, and checks them against public CVE databases — no local Python environment required. Here's the flow:
- Go to /scanner/pypi or the general /scan page.
- Open the Paste Text tab, or Upload File to drag the file in directly.
- Paste
requirements.txt,Pipfile.lock, orpoetry.lock— all three are supported and parsed the same way. - Click scan. GeekWala checks each package against the OSV database, which includes the PyPA advisories for PyPI.
- Review findings ranked by exploit likelihood, not just theoretical severity.
No account is required for a quick check, but an anonymous scan covers only the first 10 packages (and allows 3 successful scans per day per IP) — enough for a small requirements.txt. For a full lockfile, create a free account (no credit card): a free account lifts the 10-package cap and keeps scan history (up to 200 tracked packages on the free plan), and Pro adds scheduled re-scans as new CVEs land against your dependencies.
Reading Your Results: EPSS and CISA KEV Alongside CVSS
CVSS tells you how severe a vulnerability could theoretically be. It doesn't tell you whether it's actually being exploited — and that gap is exactly where teams triaging by severity get burned, patching every "critical" finding while an actively-exploited moderate one sits in the backlog. Two additional signals close that gap.
EPSS is a FIRST.org model estimating the probability a CVE gets exploited in the next 30 days, updated daily from real exploitation telemetry. CISA KEV goes further — it's a catalog of more than 1,700 CVEs CISA has confirmed are being actively exploited right now. At most 6% of published CVEs are ever exploited; EPSS and KEV together tell you which 6% you're actually looking at, instead of triaging blind by CVSS alone.
Pinned vs Unpinned Requirements: Why Exact Versions Matter
A scanner can only match a vulnerability database entry to a package at a specific version — requests>=2.0 doesn't tell it which of dozens of releases you actually have installed. Pipfile.lock and poetry.lock always pin exact versions, so they scan cleanly. A loose requirements.txt with version ranges instead shows: "Enter exact version to enable scanning" next to affected entries. Run pip freeze > requirements.txt (or generate a lockfile with pipenv lock / poetry lock) to get exact pins, then re-scan for a complete result.
pip-audit vs a Hosted Scan: What Each Is For
pip-audit is genuinely good — it's maintained under the Python Packaging Authority, free, and runs against the same PyPA Advisory Database GeekWala also draws on. Where it falls short is prioritization: its default output lists each finding's package, version, advisory ID and fix version, with no severity or exploitation signal, so every finding looks equally urgent and a team working top-down can patch the wrong ones first. A hosted scan doesn't replace pip-audit in your CI pipeline — it's faster for a one-off check with no environment setup, and layering EPSS plus KEV onto the same findings tells you which of pip-audit's results to act on first, this week, versus which can safely wait for the next sprint. For a worked example of how exploitation data reorders a Python team's priorities, see what pip-audit misses; to see how the two tools compare feature-by-feature, see pip-audit alternatives. For JavaScript projects, see how to check package.json for vulnerabilities online.
Frequently Asked Questions
Is it safe to paste requirements.txt into an online scanner?
A requirements or lock file lists package names and versions, not source code or credentials, so pasting it carries minimal exposure — this is the same information PyPI itself sees on every pip install. If your internal package names are sensitive, review the file first, but the dependency list is otherwise unremarkable to share.
Does this replace running pip-audit locally or in CI?
No — treat it as a faster front door, not a replacement. pip-audit in CI catches regressions on every commit with no manual step; a hosted scan is for the moments you want an answer immediately, on a file you don't yet have set up locally, without configuring a Python environment first.
What's the difference between scanning requirements.txt and Pipfile.lock or poetry.lock?
All three are supported at /scanner/pypi and parsed the same way. Pipfile.lock and poetry.lock always carry exact pinned versions (more accurate results); requirements.txt only pins exact versions if you wrote it that way or generated it with pip freeze.
Can this catch vulnerabilities pip-audit's advisory database misses?
GeekWala cross-references OSV, which aggregates the PyPA Advisory Database alongside other sources, plus adds EPSS and CISA KEV context pip-audit doesn't surface on its own. Running both and comparing results is a reasonable belt-and-suspenders approach for anything shipping to production.
How often should I re-scan my Python dependencies?
New CVEs land against PyPI packages continuously, so a clean scan today can show a finding next week with zero code changes on your end. Scan before a release, gate pull requests that touch requirements.txt/Pipfile.lock/poetry.lock in CI, and run a scheduled weekly scan to catch disclosures against dependencies you haven't recently touched.
Scan your Python dependencies now → — free, no signup, results in under a minute.
