DepSentry

Security data is easy to fetch and surprisingly annoying to read. A CVE lookup can mean bouncing between advisory pages, package metadata, version ranges, and severity scores.

DepSentry is my attempt to make that first five minutes less scattered. Enter a CVE ID and it pulls the record live from OSV.dev, then uses deps.dev to fill in CVSS scores and advisory links. The result is one place to answer the useful questions: what is affected, which versions are in range, and where to read more.

The underlying lookup is intentionally legible:

curl https://api.osv.dev/v1/vulns/CVE-ID

The goal is not to replace a security platform. It is to make the first question easier to answer.

The lookup path

• Look up: enter a CVE directly in the UI.
• Inspect: see affected packages, vulnerable version ranges, aliases, scores, and advisories.
• Bulk check: upload package.json, requirements.txt, or an SPDX SBOM.
• Degrade gracefully: keep the core OSV result useful when the enrichment layer is unavailable.
• Cache: keep repeat lookups fast with Redis.

Under the page

The frontend is a React + Vite app. A Python FastAPI service proxies requests to OSV.dev and deps.dev, with Redis handling the cache. Docker Compose ties the pieces together locally; deployment splits the backend and Redis onto Railway and the frontend onto Vercel.

I like the restraint in this project. It takes public vulnerability data that is already available and shortens the distance between “is this dependency exposed?” and evidence you can actually inspect.