EN
FrançaisEnglishPolski
Analyse a file
FeaturesDependency analysisCode analysisWebsite scannerGitHub, CI and coding assistantsClient reportCRA for software vendors
Analyse a file
FrançaisEnglishPolski

Analyse your project.

No account needed. What Tamiso reads depends on what you send, and the result is deleted after 24 hours.

New check 25 MB at most, or a .zip archive of the project
You send Packagesknown vulnerabilities Codesecrets, common mistakes
A dependency filepackage-lock.json, requirements.txt, SBOM, Trivy report… Yes No, the file contains none
A .zip archive of the projectboutique.zip Yes Yes, in memory
The address of a public GitHub repositorygithub.com/organisation/projet Yes Yes, in memory
requirements.txtpoetry.lockpackage-lock.jsonpnpm-lock.yamlyarn.lock

Also pyproject.toml, Pipfile, uv.lock and package.json, composer.json and composer.lock (PHP), Gemfile and Gemfile.lock (Ruby), go.mod (Go), Cargo.toml and Cargo.lock (Rust), pom.xml, build.gradle and gradle.lockfile (Java), .csproj and packages.lock.json (.NET), bun.lock, a .zip archive of the whole repository, CycloneDX or SPDX SBOMs in JSON and Trivy, Snyk, OSV-Scanner, Dependabot or SARIF reports. Several files at once: Tamiso merges them without duplicates and skips the ones it cannot read.

What we read

From a dependency file: package names and versions, and vulnerabilities already reported by another scanner. From a .zip archive or a repository: the code as well, analysed in memory and then forgotten (only the file, the line and a short masked excerpt are kept for 24 hours). Nothing is sent to an AI without your consent.

Where we look

Known vulnerabilities and malicious packages in OSV, the EPSS exploitation probability and the CISA catalogue of exploited vulnerabilities. On PyPI and npm, Tamiso also checks that each package exists, is not too recent, does not imitate the name of a well-known package and that its version has not been withdrawn by its authors.

What you get

The updates to make first, the dismissed vulnerabilities with their reason, and a prompt ready to paste into your AI assistant.