Wisec

The next Log4Shell lands. One search tells you whether you are affected.

Which projects, which branches, which versions contain this component, and since when?

Wisec keeps the inventory of every build. A search by component or by vulnerability goes through that whole history, and the answer also says what it does not know.

By component or by CVEYour whole build historySigned report
1 · The history

Every build left its inventory.

Each row is a project branch, each block one of its builds. The agent recorded the dependencies of each: the answer exists before the question is asked.

2 · The search

The whole history, in one pass.

The search lights every build that contains the component, and tells those where it is still in the latest build from those where it was already removed.

Illustrative example
Still in the latest buildPresent before, removed since
3 · The nuances

What is not known is said.

A version declared as a range is marked undetermined, never dropped. A branch whose latest build recorded no inventory is listed: silence is not "not affected".

Illustrative example
Still in the latest buildPresent before, removed sinceDeclared range: undeterminedNo inventory recorded
4 · The report

A signed answer to hand over.

The result becomes a PDF report: signed, anchored on IPFS and logged in Rekor, with a QR code to the statement. It holds no personal data.

The answer

An answer you can pass on as it is.

For each project and branch: the version found, the first and last time it was seen, and whether the latest build still contains it.

Project and branch

Where, and since when.

First and last appearance, kept even after retention has deleted older builds.

Latest build

Still there, or removed.

The distinction between a current exposure and a past one.

Declared ranges

Undetermined, never dropped.

A dependency declared as "^2.14" may be affected: it stays in the answer, marked as such.

Blind spots

What was not inventoried.

Branches without an inventory and the start of the kept history are stated, so that an empty result is never read as no risk.

Search for "log4j-core", illustrative example
Project / branchAnswer Illustrative example
api / mainStill in the latest build
billing / release-2.xRemoved since
frontend / mainNot found
worker / mainDeclared range: undetermined
legacy-batch / mainNo inventory recorded
By vulnerability

Start from a CVE, not from a package name.

Enter a CVE or GHSA identifier. Wisec finds the packages concerned by following the advisory's aliases, then checks each recorded version against the OSV vulnerability database, kept in our cluster in France: no home-made version comparison.

  • Versions checked one by one. Each recorded version is declared affected or not by the OSV database itself.
  • Ecosystems covered: Maven, npm, PyPI, Go. Those Wisec does not inventory are named in the answer rather than passed over.
  • Existing detections listed. If a scanner already reported the vulnerability on a project, the answer shows it.
  • An unavailable database is never a "no". If the check cannot run, the search says so and does not give half an answer.
The signed report

The answer your customer or your authority expects.

The report is recomputed on the server, never from a result sent by the browser, then signed with the Wisec attestation key, anchored on IPFS with a copy in storage that cannot be altered, and logged in Rekor. A third party verifies it without a Wisec account, with standard tools.

Wisec never says "shipped". It sees branches and commits, not your releases to production. The report says where the component was built; what was deployed is for you to say.

Available on the Business and Pro plans. The search covers the history your plan keeps, and the answer states the date from which that history is complete.

Book a demoRead the documentation