Dependency audit

Upload your stack. See what blocks release.

Start with the files developers already have. Publicus separates registry truth, fresh upstream evidence, unknown packages, Canada-readiness signals, and the concrete fixes to address first.

Scan dependency file Check one package
1 Upload or check Use a package file, lockfile, SBOM, or one package name.
2 Fix blockers first See blocked, needs-review, unknown, and unpinned entries before the full evidence list.
3 Export proof Download JSON or browser-generated Markdown evidence packs for review. Package names and versions can be sensitive, so review before publishing.
Stack scan

Run a vulnerability and registry audit.

No file scanned.

Upload a file for a stack-level audit, or check one package before adding it to a project. Results stay evidence-first and inspectable.

Visible support: package.json, requirements.txt, pyproject.toml, Pipfile.lock, Cargo, Go, CycloneDX, SPDX, and plain package lists.

Supported files and best results

Supported today: package.json, package-lock.json, yarn.lock, requirements.txt, pyproject.toml, uv.lock, poetry.lock, Pipfile.lock, Cargo.toml, Cargo.lock, go.mod, go.sum, CycloneDX JSON, SPDX JSON, and plain .txt package lists.

Lockfiles and SBOMs with exact versions produce the strongest result. Manifests with ranges still show registry status, but unpinned entries are marked as review gaps.

How to read results Evidence pack format
No file yet?

Check one package directly.

Use this for a package your AI tool suggested before you add it to a project. Exact versions give the strongest result; ranges are treated as review context.

Package lookup uses the same evidence path as uploads.
Upload a file to scan dependencies. You will see blockers first, then package-level verdicts, freshness, source links, and evidence drill-downs.