Type the version you run. Read the verdict and the rule behind it.
SIP is a read-only GitHub App. It parses text and never executes your code.
An AI model never sets urgency and never takes an action. Seven of the rules, in the order they are checked:
| Rule | When | Level |
|---|---|---|
| C1 | Confirmed affected, and listed in CISA KEV or a verified exploit exists (not dev-only) | Critical |
| C2 | Confirmed affected, high exploit probability (EPSS), production Internet-facing repository | Critical |
| C3 | Confirmed affected, critical CVSS, production Internet-facing repository | Critical |
| W1 | Confirmed affected with high or critical CVSS, no exploit evidence | Warning |
| W2 | Possibly affected (version not resolvable) and exploit evidence exists | Warning |
| I2 | Affected dependency is only in development or test scope | Info |
| I4 | Repository is not production Internet-facing and there is no exploit evidence | Info |
A failed or partial check is shown as failed or partial, with the reason. “No alerts” only ever means the check ran. Example data:
| Repository | Check | Detail |
|---|---|---|
| acme/storefront | Checked fully | 12 minutes ago |
| acme/api | Partial | No lockfile for 12 dependencies, so their versions are unconfirmed |
| acme/docs | Checked fully | 3 hours ago |
| acme/billing | Failed | GitHub returned 403 while reading package-lock.json |
Loading plans…
No. SIP is a read-only GitHub App. It cannot push, open pull requests or change settings.
No. SIP reads only manifests, lockfiles, Dockerfiles, runtime version files and workflow files. It parses them as text and never runs your code. Source code is never sent to an AI model.
SIP checks the exact installed version, ranks urgency using exploitation data (CISA KEV, EPSS) and how exposed the repository is, and tells you the reason. It also imports Dependabot, SARIF and OSV-Scanner results so everything sits in one place.
You see it. A failed or partial check is shown as failed or partial on the dashboard and in digests. “No alerts” never hides “we could not check”.
Node.js (npm, pnpm, Yarn), PHP (Composer) and Python (pip, Poetry, uv). Docker base images are next.
Yes. Organize repositories as Client → Project → Repository and export a report per client or project.