The most accurate check: your dependency lockfile has the
exact installed versions, so this confirms or clears CVEs
instead of guessing. Checked against the OSV database. Your file stays in your
browser β only package names/versions are sent for lookup.
π Privacy: your lockfile is
processed in memory and never stored β it is not written to disk, logged,
or retained anywhere. Only the package names and versions (never the file itself)
are sent to the OSV database
to look up known advisories.