Product · OSS / SCA

Your SDKs have SDKs.
We read those too.

Nandee maps every direct and transitive dependency in your Gradle, CocoaPods, and Swift Package Manager builds, flags the ones with known vulnerabilities, and tells you the smallest upgrade that clears them.

Scan your appBook a demo
app okhttp 4.12.0 kotlinx-coroutines 1.8.1 acme-analytics 2.3.0 gson 2.10.1 protobuf-javalite 3.11.0 okio 3.9.0 lottie 6.4.0 play-services-auth 21.2.0 room-runtime 2.6.1 Came in with your analytics SDK. Nobody picked it. FIX · BUILD.GRADLE.KTS MEDIUM - protobuf-javalite 3.11.0 + pin protobuf-javalite 3.25.5

What it reads

All the code
you didn't write.

  • Android

    Gradle and Maven

    Every module, build variant, and version catalog entry.

  • iOS

    CocoaPods and Swift packages

    Resolved from your lockfiles, so you see what actually ships.

  • Transitive

    The packages your packages chose

    The full tree, with the path that brought each one in.

  • Vulnerabilities

    Known issues, matched by version

    Checked against public CVE and GitHub security advisories.

  • Stale

    Libraries nobody maintains

    Packages that stopped getting updates, before they become next year's CVE.

  • Upgrade path

    The smallest safe bump

    The lowest version that clears the issue, so upgrades don't turn into rewrites.

Example finding

Three levels down, one known bug.

MediumSCACVE-2021-22569 · MASVS-CODE-3app/build.gradle.kts

protobuf-javalite 3.11.0, via acme-analytics

A small crafted message can keep the parser busy for minutes, freezing whatever thread is reading it. Fixed upstream in 3.16.1. You never added this package, so you'd never think to update it.

How it got here
app
└ com.acme:analytics:2.3.0
  └ com.google.protobuf:protobuf-javalite:3.11.0

Not in your build file. Still in your app.

Suggested fix
dependencies {
  constraints {
    implementation("com.google.protobuf:protobuf-javalite:3.25.5") {
      because("CVE-2021-22569, via acme-analytics")
    }
  }
}

Pin it here. No fork of the SDK needed.

Where SCA fits

  1. 01ConnectUpload a build or link CI
  2. 02 · This pageReadSAST, DAST, and SCA
  3. 03TriageFalse positives out, ranked
  4. 04 · Early accessAttack pathsRed Agent chains findings
  5. 05FixGreen Agent writes it
  6. 06 · EnterpriseReviewPeople sign off

Fair questions.

Does every CVE get flagged?

Every match is found. Then AI Triage removes the ones that don't apply to your app and ranks the rest by how exploitable they are.

What about licenses?

Yes. We identify the license of every direct and transitive dependency and flag copyleft licenses (like GPL and AGPL) and unknown licenses, so legal can review before release. You can set which licenses to allow or block.

Can we export an SBOM?

Yes, in CycloneDX and SPDX, as JSON.

Meet the code you didn't know you shipped.

Scan your app