Back to the Juice Shop example

Paste a public repository

TakeApart reads a lockfile, a pinned requirements.txt, go.mod or a committed SBOM at the repository’s root.

For a private repository, upload its lockfile and manifest instead (the link below). They’re read in your browser, and only the package list is sent.

A pasted repository is read by TakeApart’s server through GitHub’s or GitLab’s public API. It reads only the root lockfile and manifest, a pinned requirements file, go.mod, gradle.lockfile or an SBOM on the default branch, clones nothing and stores nothing. For the runtime’s version it also reads a version file (such as .nvmrc or .php-version), the Dockerfile and up to five GitHub Actions workflows. Either way, only package names, versions and the vulnerability ids found go to the vulnerability services, never a file or the repository’s address. The result isn’t saved, and reloading the page clears it.