Bundles

Security and Supply Chain Bundle

Risk removed

Covers security flaws and supply-chain (license & dependency) risk in a single pass, leaving no gap.

$259

Final price in USD. Local taxes are your responsibility.

Order assessment
Security and Supply Chain Bundle

Inspection scope

  • Exposed secrets
  • Dependency vulnerabilities
  • Static security analysis
  • Licenses
  • SBOM (SPDX 2.3)

Evidence, remediation guidance and a digitally signed PDF for the selected scope

Within 24 hours after submission

Required evidence

  • Source repository or ZIP

Full refund before analysis starts; after it starts, no refund for change of mind (full refund if we fail to issue the report within the turnaround time for reasons on our side).

Who this is for

  • Companies that want to address security flaws and open source license risks at once
  • Cases where a supplier review or due diligence requires both security check results and an SBOM

What is included

  • The full Security Triple CheckSecrets and credentials (including full git history), dependency vulnerabilities (cross-checked with Trivy and Grype), and risky code flows (semgrep)
  • The full Open Source License ReportLicense classification (ScanCode, ORT) and SBOM (SPDX 2.3)
  • One uploadInstead of ordering the two products separately, both run from a single source code upload.

What the report includes

  • Security and license results in one document: a CEO summary, file and line evidence, an SBOM, and a digitally signed PDF

How it works

  1. Upload source code: a ZIP file or a read-only repository
  2. Analysis in a closed network, with no external transfer
  3. Within 24 hours after submission: report issued
  4. 1 free rescan(s) within 30 days after you fix the issues

Frequently asked questions

How is this different from buying the two products separately?

The scope is the same; you receive everything in one document from a single upload. See the top of this page for pricing.

Is it safe to hand over our source code?

Source code is analyzed only in an isolated, closed-network environment and is never sent to an external LLM. Submitted source ZIPs, repository links and read-only tokens are automatically deleted once the assessment is complete, and the deletion is logged as evidence. If source code leaks through our system, we compensate 100 times the amount paid for that assessment (Terms of Service).

What do we receive?

A digitally signed PDF report that combines a one-page summary for the CEO with file- and line-level evidence your development team can act on directly. The report carries an authenticity-check hash, so it can be submitted to third parties.

Can we get a refund?

You receive a full refund before analysis starts. Once analysis has started, refunds are not available for a change of mind, but you receive a full refund if we fail to issue the report within the turnaround time for reasons on our side.