CVE Security Scanner
Cross-references every installed package against OSV.dev, NVD, and GitHub Advisory databases. Flags critical vulnerabilities with CVSS scoring, provides one-click fix commands, and exports audit reports in PDF/CSV/JSON.
From scan to cleanup to audit — every capability broken down.
Every package manager your Mac dev environment uses — all in a single unified dashboard.
Both formulae and casks, with full dependency trees.
Python packages with Requires / Required-by resolution.
Global Node.js packages and their transitive dependencies.
Ruby gems with full dependency analysis.
Rust binaries installed via cargo install.
Conda environments with per-env package breakdown.
Go binaries from $GOPATH/bin.
DerivedData, Archives, DeviceSupport — the disk hogs.
Images, volumes, build cache across all containers.
Python versions managed by pyenv + active version detection.
Node.js versions managed by nvm.
Ruby versions managed by rbenv.
Command Line Tools — version, path, installed size.
Dev-related launchd daemons and agents only.
Cross-references every installed package against OSV.dev, NVD, and GitHub Advisory databases. Flags critical vulnerabilities with CVSS scoring, provides one-click fix commands, and exports audit reports in PDF/CSV/JSON.
Parses .zshrc / .zprofile / .bashrc / .profile. Identifies duplicate sources, conflicting aliases, world-writable paths, and misplaced version manager initialization. Shows exactly which Python (or node, ruby, etc.) is active and why.
NEWEvery package gets a 0-100 score computed from 8 factors: dependency count, system criticality, recent usage, conflict potential, recoverability, vulnerability status, install source, and disk impact. Each score comes with a breakdown showing exactly why.
NEWRuns silent scans on your schedule (1h/6h/12h/24h). Respects battery and AC state. Surfaces critical CVEs immediately via native notifications. Never drains your Mac.
Builds a complete dependency graph spanning all 16 managers. Detects when numpy is installed via both pip and conda. Flags orphan packages no one depends on. Finds packages your environment silently needs.
Snapshots fire automatically before any uninstall, cache purge, or environment change. Each includes package state, shell config backup, and PATH. Restore builds a step-by-step plan with warnings — you confirm each step.
One button purges Homebrew cache, pip cache, npm cache, Xcode DerivedData, CocoaPods cache, Docker builder cache. Typical free: 3-10 GB.
Generates a single setup.sh that recreates your entire dev environment: Brewfile, requirements.txt, package.json, Gemfile, Cargo installs, Conda environments. One bash command to replicate everything on a new Mac.
A single Health Score (0-100) summarizes your entire dev environment. Compare reports over time to see what improved or degraded. Export professional PDFs — perfect for freelance client audits or team reviews.
NEWGoes beyond package CVEs to check your Mac's own security posture. Inspects firewall state, FileVault encryption, Gatekeeper policy, SSH daemon config (PermitRootLogin, PasswordAuthentication), sudo NOPASSWD rules, and world-writable entries in your PATH. Each finding comes with a severity level and a copy-paste fix command — no Terminal expertise required.
NEWStart with the free version. Upgrade when you need CVE scanning or PATH diagnosis.