Pricing
Free helps you keep an eye on your dependencies. Pro adds scale and private inventories. Premium is our planned service for proposing code fixes.
Understand your stack and follow the packages that matter.
Or $60 USD / year — save $12 versus monthly billing.
For when a dependency needs a fix and upgrading alone is not enough.
Pro does not include AI-generated patches. GitHub analysis needs the GitHub App connection to be enabled. Wiz and other vendor imports use supported SBOM exports or CI uploads; native direct connectors currently cover JFrog Artifactory and Xray. Vendor subscriptions are separate.
A watched package counts once across your projects. Public checks are subject to normal rate limits. Premium entries describe planned scope, not an active entitlement.
| Feature | Free | Pro | Premium · planned |
|---|---|---|---|
| Public package search, assessments and project checks | Included | Included | Planned: included |
| Supported package ecosystems | npm, PyPI, Cargo, Go, Maven, NuGet, RubyGems | All 7 | Planned: all 7 |
| Unique watched packages | 25 | 1,000 | Not set yet |
| Email alerts and weekly digest | Included | Included | Planned: included |
| Live feed, supply-chain news and trendlines | Included | Included | Planned: included |
| Slack / Discord and private watchlist feed | Not included | Included | Planned: included |
| Private GitHub analysis | Not included | 5 repositories; root package.json + package-lock.json; App setup required | Planned: broader project context for patching |
| Private GitHub analysis allowance | Not included | 20 analyses per rolling 24 hours; up to 500 direct dependencies per analysis | Not set yet |
| Platform integration sources | Not included | 5 sources, separate from GitHub repositories | Planned: included; final limits not set |
| SBOM formats | Not included | CycloneDX JSON 1.4–1.6; SPDX JSON 2.2–2.3 | Planned: included |
| Direct vendor connections | Not included | Artifactory inventory; Xray artifact findings (read-only) | Planned: included |
| Wiz, GitLab, Snyk, Sonatype and other platforms | Public news where available | Supported SBOM exports / CI uploads; no native tenant API connection yet | Planned: included |
| Integration inventory limits | Not included | 2,000 components; 2,000 supplied findings; 2 MiB JSON per source | Not set yet |
| Integration upload / manual sync allowance | Not included | 20 actions per rolling 24 hours; hourly scheduled connector refreshes | Not set yet |
| Private data retention | Not applicable | GitHub reports: 30 days; integration sources and credentials: expire 30 days after creation | Not set yet |
| Repository-aware AI patch generation | Not included | Not included | Planned; not live |
Private GitHub analysis currently covers root npm manifests and lockfiles, not full project code or every ecosystem. Connection availability is shown before you authorize GitHub.
Integrations import existing inventory and findings; they do not run a new vendor security scan. Xray requires an eligible vendor subscription and a completed scan. Direct JFrog connectors still need validation with your tenant. Provider scan times and successful sync times are shown separately.
You can manage your subscription from your dashboard. Private data stays out of the public crawl queue, and you can delete retained private sources after downgrading.
Open plan and billing settings →