# Vulnerabilities in your stack, seen first.

Source: https://libwatch.com/en/index

Security monitoring · dependencies, languages, WordPress

LibWatch monitors the dependencies in your GitHub and GitLab repositories, your language versions and your WordPress sites. It tells you when a vulnerability actually affects you, and what to fix first.

[Analyze a project](https://app.libwatch.com/users/sign_up?source=home_hero)

[See pricing](/en/pricing)

14-day trial, then from €39 excl. VAT per month · Hosted in France by OVHcloud

[Active alert PHP2Shell: two critical vulnerabilities in the PHP engine. Check your PHP projects →](/en/cve/php2shell)

## What LibWatch can read

- [Composer](/en/ecosystems/php-composer)
- [npm](/en/ecosystems/javascript)
- [Yarn](/en/ecosystems/javascript)
- [pnpm](/en/ecosystems/javascript)
- [PyPI](/en/ecosystems/python)
- [RubyGems](/en/ecosystems/ruby)
- [Maven](/en/ecosystems/java-kotlin)
- [Gradle](/en/ecosystems/java-kotlin)
- [Go](/en/ecosystems/go)
- [NuGet](/en/ecosystems/dotnet)
- [Cargo](/en/ecosystems/rust)
- [Swift](/en/ecosystems/swift)
- [CocoaPods](/en/ecosystems/swift)
- [Pub](/en/ecosystems/dart-flutter)
- [WordPress](/en/ecosystems/wordpress)

How it works

## Three steps, then it runs on its own

No pipeline to change to get started: connecting your account is enough.

1.

### Connect your projects

GitHub, GitLab (self-managed included) or a WordPress site. Choose the repositories to monitor.

2.

### LibWatch builds the inventory

It reads your dependency files and language versions, and keeps only the list of packages and their versions.

3.

### You hear about it when it matters

Exploited vulnerabilities (KEV catalog) come first, then the most severe; alerts go out by email, Slack, Zulip or webhook.

What other scanners miss

## More than a list of packages

- [

End of life

### Your language too

An up-to-date library running on PHP 8.1 or Ruby 3.0 is still exposed. LibWatch tracks support for your languages and frameworks.

 End-of-life detection → ](/en/features/end-of-life)
- [

CERT-FR

### French security alerts

Advisories and alerts from ANSSI, the French cybersecurity agency, are built in for PHP: an affected PHP version is flagged by the following night at the latest.

 Alert prioritization → ](/en/features/prioritization)
- [

One plan

### Git and WordPress together

A repository or a WordPress site counts as one project. No separate tools for code and for sites.

 For agencies and IT service providers → ](/en/agencies)
- [

Every night

### Even forgotten projects

The inventory is checked against new vulnerabilities every night, without using up an analysis.

 Nightly watch → ](/en/features/nightly-watch)
- [

SBOM

### CycloneDX and SPDX

Export a machine-readable bill of materials, validated against the official schemas.

 SBOM export → ](/en/features/sbom-export)
- [

MCP server

### Queryable by your AI tools

Your AI assistants look up the vulnerabilities in your projects, and start an analysis if you allow it.

 The MCP server → ](/en/features/mcp-server)

Privacy

## Your code stays with you

LibWatch reads your dependency files through the GitHub or GitLab API and keeps only the list of your packages and their versions. No repository is cloned, no code is executed.

### What LibWatch keeps

- — The name and version of each package
- — The declared language versions
- — The vulnerabilities found and their history

### What it does not do

- — Clone your repository: only dependency files are read, one at a time

[All the details: permissions requested, tokens, hosting →](/en/security)

LibWatch in numbers

- 14

- 2 a.m.

- 1 night

- 14 days

Frequently asked questions

## Before you connect your repositories

[Another question? Write to us →](mailto:bonjour@isee-u.fr)

### Does LibWatch read my code?

 No. It only reads your dependency files, one at a time, through the GitHub or GitLab API, and keeps the list of packages and their versions. No repository is cloned.

### Do I need to change my CI pipeline?

 No. LibWatch connects to GitHub or GitLab and reads your dependency files through their API: nothing to add to your pipeline.

### Which ecosystems are covered?

 Composer (PHP), npm, Yarn and pnpm (JavaScript), PyPI (Python), RubyGems (Ruby), Maven and Gradle (Java, Kotlin), Go, NuGet (.NET), Cargo (Rust), Swift and CocoaPods, Pub (Dart, Flutter), plus WordPress sites.

### What happens at the end of the 14-day trial?

 Your subscription to the plan you chose continues: its price is charged to your card, then every month. If you don't want to continue, cancel before the trial ends from the Subscription page in the app: nothing is charged. If a payment fails, you have 7 days to update your card.

## Your first project is analyzed in minutes.

Connect a repository or a WordPress site. You will immediately see its vulnerabilities, its language versions and what needs fixing.

[Analyze a project](https://app.libwatch.com/users/sign_up?source=home_final)

Hosted in France by OVHcloud