Platform

Risk, context, and the fix, in one place.

Discovery, prioritization, impact analysis, monitoring, and remediation in one place, without ever touching your source code.

01 · VisibilityYour whole estate,
in one view.

Every project, repository, pipeline, and production image, mapped on its own and scored by what actually matters.

Dashboard

ForLeadership and compliance

Log in and know if you’re safer than last week.

The first screen after login covers your whole organization: open vulnerabilities by severity compared to the previous week, a 30-day trend, OWASP Top 10 and Sonar results, and the projects carrying the most risk.

Leavory · Dashboard 4 projects monitored

Welcome, Alex. Here you can track projects, repositories, and application security in one place.

Projects discovery: 41 min agoRepositories discovery: 6 min agoPipelines discovery: 5 min ago

Critical12

2 vs previous week

High239

23 vs previous week

Medium116

4 vs previous week

Low41

4 vs previous week

Secrets2

— no change this week

Vulnerability trend, last 30 days

CriticalHighMedium

Quick summary

Projects found4
Repositories found148
Pipelines found214
Pipelines with Trivy analysis58

Distribution by severity

410 open vulnerabilities

Critical	12	2.9%
High	239	58.3%
Medium	116	28.3%
Low	41	10.0%
Secrets	2	0.5%

OWASP Top 10

A01 Broken access control21
A02 Cryptographic failures14
A03 Injection18
A04 Insecure design6
A05 Misconfiguration27
A06 Vulnerable components34
A07 Auth failures9
A08 Integrity failures5
A09 Logging failures7
A10 SSRF3

Sonar issues

Bugs23
Vulnerabilities11
Code smells138
Security hotspots29

Top projects by vulnerabilities

#	Project	Vulnerabilities
1	Commerce	218
2	Finance	102
3	Identity	56
4	Platform	34

Audit-ready by default

OWASP Top 10 static analysis runs in your pipeline on every build, right next to SCA and SBOM, from a step Leavory writes for you. The next security questionnaire, audit, or pentest starts from evidence you already have, not a scramble.

Projects

ForPlatform and engineering managers

Connect once, and your whole organization is mapped.

On its first run, Leavory finds every project in your organization on its own and shows the languages, repository count, and combined vulnerabilities of each. One more click discovers the repositories and pipelines of all of them.

Leavory · Projects 4 projects discovered

4 projects found, last search on 9/26/2026, 8:47 AM.

Discover repositories and pipelines for allUpdate

Projects discovery: 41 min agoRepositories discovery: 6 min agoPipelines discovery: 5 min ago

Total projects

Total repositories

148

Unique technologies

Vulnerabilities

12 Critical 239 High 116 Medium

Health

82Good

Not discovered yet

Project	Description	Language	Repositories	Actions
Commerce	Storefront, checkout, and payments	JSGOPY.NET	52	DiscoveryOpen in Azure DevOps
Platform	Shared infrastructure and Helm charts	GOPYRS	37	DiscoveryOpen in Azure DevOps
Finance	Billing, invoicing, and reporting	PYJAVAJS	38	DiscoveryOpen in Azure DevOps
Identity	—	JAVAJS	21	DiscoveryOpen in Azure DevOps

Showing 4 of 4 projects

Open a project to see how it ships, not just what it carries.

Every project gets its own overview: DORA metrics like deployment frequency, change failure rate, and time to recover, a day-by-day view of pipeline runs, and a 30-day trend of open vulnerabilities. You see a new CVE land, and you see it go away.

Leavory · Commerce 52 repositories

Projects

CommerceNode.jsGoPython.NET

Open in Azure DevOps

OverviewRepositoriesPipelinesPackagesGovernance

Inventory

Repositories

Pipelines

Failing pipelines

Vulnerable packages

Delivery (DORA metrics)

Deployment frequency

6.4/day

Change failure rate

8.1%

MTTR

3h 12m

Avg. pipeline duration

11m 20s

Pipeline activity, last 30 days

SucceededFailedOther

Vulnerability trend, last 30 days

CriticalHighMedium

Repository health

ForDevelopersPlatform and engineering managers

Every repository, scored from 0 to 100.

Inside each project, Leavory lists every repository with a 0–100 health score, next to its open vulnerabilities, vulnerable packages, pipeline results, last commit, and last release. One table that developers and managers read the same way.

Leavory · Repositories 148 repositories discovered

Projects discovery: 41 min agoRepositories discovery: 6 min agoPipelines discovery: 5 min ago

Total repositories

148

With pipeline

Active

148

Vulnerabilities by origin

236 Application131 Container

Vulnerabilities

12 Critical 239 High 116 Medium

Overall health

82Good

Repository	Language	Pipelines	Health	Vulnerabilities	Vuln. packages	Last commit	Last release
checkout-platform Commerce	JSGO	4 pipelines 922 3 days ago	31Critical	5 Critical 101 High 12 Medium	21	3 days ago Ka1f93c2 Merged PR 236: fix cart total rounding	release/3.14.2 9/21/2026
payments-api Commerce	GO	2 pipelines 310 5 days ago	44Critical	4 Critical 37 High 6 Medium	24	5 days ago L5e02b7d Merged PR 218: bump grpc to 1.66	release/2.9.0 9/18/2026
billing-service Finance	PY	2 pipelines 420 6 days ago	58Fair	1 Critical 39 High 35 Medium	11	6 days ago Tc47d1a9 Merged PR 205: add invoice retry job	release/1.12.3 9/14/2026
auth-service Identity	JAVA	1 pipeline 310 12 days ago	74Fair	0 Critical 16 High 22 Medium	0	12 days ago T98ab3f0 Merged PR 187: rotate signing keys on deploy	release/6.1.0 9/10/2026
infra-helm-charts Platform	—	38 pipelines 1513718 1 day ago	83Good	1 Critical 4 High 9 Medium	0	1 day ago N7fd0e14 fix(gateway): raise ingress memory limits	release/7.3.0 9/23/2026

Showing 5 of 148 repositories, sorted by health

For developers

Open the repository you own and see what is failing, which packages are vulnerable, and what shipped in the last release.

For managers

Sort every repository by health and see where the risk is concentrated, without asking each team for a status report.

Pipelines

ForDevelopersPlatform and engineering managers

Every pipeline, one dashboard, zero blind spots.

Leavory centralizes every pipeline across Azure DevOps, GitHub, and GitLab into a single view, so you always know which builds shipped a new vulnerability and which ones are clean.

Leavory · Pipelines 10 pipelines monitored

	checkout-web / build-deploy4m ago	2 Critical1 HighFailed
	payments-api / release12m ago	1 Critical3 HighFailed
	auth-service / ci28m ago	1 HighPassed
	billing-service / ci41m ago	2 MediumPassed
	mobile-gateway / build-deploy1h ago	2 High1 MediumFailed
	notifications-worker / ci2h ago	3 LowPassed
	infra-terraform / plan3m ago	CleanRunning
	docs-portal / deploy5h ago	CleanPassed
	inventory-service / ci6h ago	1 MediumPassed
	reporting-api / release9h ago	1 CriticalFailed

OWASP Top 10, ready to add

Pick a repository and Leavory writes the Semgrep step for Azure Pipelines, GitHub Actions, or GitLab CI. Your team reviews it and adds it to the pipeline: Leavory keeps read-only access and collects the results.

Image monitoring

ForSecurity teams

Your images don’t change. Their vulnerabilities do.

Group the container images your workloads run into a project, and Leavory takes it from there: a full scan every day at 00:00 and 12:00, and an alert the moment any of them gets worse, by email, Microsoft Teams, Slack, or all of them, whatever your team needs. No pipeline run, no one clicking scan.

Leavory · production-cluster Next scan at 00:00 UTC

6 images · last 7 days

ImageMonTueWedThuFriSatSun

nginx:1.27Docker Hub · image unchanged

redis:7.2Docker Hub · image unchanged

postgres:16Docker Hub · image unchanged

node:20-alpineDocker Hub · image unchanged

payments-api:2.4.1AWS ECR · image unchanged

ghcr.io/acme/gateway:latestGHCR · image unchanged

CleanMediumHighCritical

Each pair of cells is one day: 00:00, 12:00

The same alert, where your team already works

EmailSat 12:04

alerts@your-company.com, via your SMTP

New vulnerabilities in production-cluster

1 image got worse since the previous scan.

nginx:1.27+1 Critical

CVE-2026-28114 · libxml2

Full results attached as CSV

Slack12:04 PM

#security-alerts

L Leavory APP

production-cluster: new vulnerabilities in 1 image

nginx:1.27 +1 Critical

Critical 3 (+1) · High 9 · Medium 14

Microsoft Teams12:04 PM

Security › Alerts

Leavory via Workflows

production-cluster: new vulnerabilities in 1 image

Critical: 3 (+1)
High: 9
nginx:1.27: +1 Critical

Catches CVEs disclosed after you ship

An image that passed clean on build day can be exposed a week later. Leavory rescans every image twice a day against the latest vulnerability database, so the day a new CVE lands, you know which images carry it.
Covers the images you didn’t build

nginx, redis, postgres, base runtimes: most of what runs in production comes from someone else. Add any public or private image from Docker Hub, GHCR, or AWS ECR. Moving tags like :latest are checked daily and the new release is pulled automatically.
One alert, only when it got worse

Alerts fire when an image has more vulnerabilities than its previous scan, not on every run. Send it by email through your own SMTP, to Microsoft Teams, to Slack, or to all of them, and every send is logged as evidence for your next audit.

02 · IntelligenceFrom a new CVE to the fix.

Trivy tells you what is vulnerable. Leavory tells you what is being exploited right now (CISA KEV), where each CVE lands across your projects, who owns it, and the fix drafted for your team to review.

Vulnerability intelligence

ForSecurity teams

Only the CVEs that hit your packages and are being exploited.

Every day, Leavory syncs six vulnerability sources into one base. Then it drops everything that doesn’t touch a package you use, and puts first what attackers are already exploiting. No feed to scroll, and no CVE raised just because it exists.

Leavory · Vulnerability intelligence 6 sources synced today

OSVPackage advisories by ecosystemSynced 06:02

NVDCVE details and CVSSSynced 06:05

GitHub Advisoriesnpm, Maven, PyPI, Go, NuGetSynced 06:07

CVE.orgOfficial CVE recordsSynced 06:09

CISA KEVExploited in the wildSynced 06:10

EPSSExploitation probabilitySynced 06:11

Daily advisories

Sep 11, 2026

214new advisories across the six sources
6hit a package version you use
1exploited in the wild

Matched against the SBOM of your repositories, pipelines, and container images, down to the package version.

Needs action

Exploited first, then by EPSS

CVE	Severity	CISA KEV	EPSS	Affected
CVE-2026-28114libxml2	Critical	Exploited	0.94	5 repos, 1 image Commerce, Finance, Platform
CVE-2026-27731jackson-databind	High	Not in KEV	0.21	2 repos Identity, Finance
CVE-2026-28002golang.org/x/net	High	Not in KEV	0.09	3 repos Commerce, Platform
CVE-2026-27950axios	Medium	Not in KEV	0.04	4 repos Commerce
CVE-2026-28190urllib3	Medium	Not in KEV	0.02	1 repo Finance
CVE-2026-27884Newtonsoft.Json	Low	Not in KEV	0.01	1 repo Commerce

Inventory exposure

Know your exposure before the first scan.

When Leavory runs in your environment, the repository inventory reads each dependency manifest and matches every declared package and version against published CVEs. Even repositories whose pipelines never ran a scan show up with their known vulnerabilities.

Leavory · Inventory In your environment · manifest reading on

Repositories inventoried

148

With a dependency manifest

131

Packages declared

6,412

Packages with a known CVE

214

Most exposed repositories

Ranked by severity, from manifests only

Repository	Manifests	Packages	Critical	High	Medium	Exposure	Pipeline scan
checkout-platformCommerce	package.json go.mod	21 / 412	5	31	12	Critical	3 days ago
legacy-reportsFinance	pom.xml	17 / 188	3	22	9	Critical	never run
payments-apiCommerce	go.mod	14 / 96	4	18	6	Critical	5 days ago
billing-serviceFinance	requirements.txt	11 / 74	1	14	10	Critical	6 days ago
partner-portalCommerce	package.json	9 / 355	1	7	15	Critical	never run
auth-serviceIdentity	pom.xml	6 / 142	0	9	8	High	12 days ago
data-sync-workerPlatform	pyproject.toml	3 / 58	0	2	5	Medium	never run
notifications-workerPlatform	package.json	2 / 121	0	1	3	Medium	2 days ago

3 of these repositories have known CVEs and have never run a pipeline scan. Without the inventory, they would not show up at all.

pom.xml
build.gradle
package.json
requirements.txt
pyproject.toml
go.mod
*.csproj

Optional. Dependency manifests only, read through the platform API with a read-only token and no clone, never your source code.

Impact analysis

ForSecurity teamsLeadership and compliance

A new CVE drops. See every project it hits, in seconds.

Leavory matches each new CVE against the SBOM of every repository and container image you own. Instead of asking every team whether they use the affected package, you get the list of projects, repositories, and images that carry it, and the ones that don’t.

Leavory · Impact analysis 3 of 4 projects · 5 repositories · 1 image affected

CVE-2026-28114 · libxml2 · Critical

RepositoryContainer imageProject not affected

Fixed in libxml2 2.13.6 · nginx:1.27.4

AI remediation

ForDevelopersLeadership and compliance

AI explains the risk and drafts the fix. Your team reviews it.

For each finding, AI says in plain language whether it’s exploitable and what to change first. For container images, it rewrites the Dockerfile with the smallest change that closes the vulnerabilities. For leadership, it turns the numbers into an executive summary.

Leavory · AI remediation AI suggestion, review before applying

CVE-2026-28114 · libxml2 · Criticalin nginx:1.27 (infra-helm-charts)

What this means

libxml2 is the XML parser inside the nginx base image. A crafted XML payload can overflow its heap and run code on the container.
It is already exploited in the wild (CISA KEV), so this is not a theoretical finding.
Start with the nginx:1.27 image in infra-helm-charts: one base image bump closes it there, then rebuild the repositories that use the same base.

Executive summary

One critical vulnerability exploited in the wild reaches 3 of 4 projects (5 repositories and 1 container image). Moving to the patched base image and rebuilding closes it everywhere. Risk is concentrated in Commerce, with 218 of 410 open vulnerabilities, so that is where remediation time pays off first.

Dockerfile

Suggested fix

- FROM nginx:1.27+ FROM nginx:1.27.4 COPY nginx.conf /etc/nginx/nginx.conf COPY dist/ /usr/share/nginx/html+ # CVE-2026-29011 (zlib): no fix published yet, tracked by Leavory EXPOSE 8080 CMD ["nginx", "-g", "daemon off;"]

AI-generated suggestion: review before applying.

Bumps the base image to nginx:1.27.4, which ships libxml2 2.13.6 and closes CVE-2026-28114. Leaves a note for CVE-2026-29011 (zlib), which has no fix published yet.

Your AI key, your data terms

AI runs on your own API key, so every request goes to your account under the data terms you already agreed with your AI provider. Leavory has no shared AI account and trains no models on your data.

AI is opt-in

Without a key, everything else in Leavory works the same: discovery, scans, alerts, prioritization, and impact analysis. Add AI when your security and legal teams are ready for it.

Fixes that fit in a coffee break

No war room, no pulling a dev off their sprint. Most remediations are just a quick code review away: review, apply, move on.

What changes when Leavory is in place.

The usual way	With Leavory
Findings spread across scanner reports, spreadsheets, and inboxes	One place for every project, repository, pipeline, and image
Thousands of CVEs, ranked by CVSS alone	A short list ranked by active exploitation (CISA KEV) and EPSS
“Are we affected?” answered by asking every team	Every project, repository, and image a new CVE hits, in one view
Images checked only when they are built	Production images rescanned twice a day, with an alert when one gets worse
Fixes researched by hand, one finding at a time	AI drafts the fix for your team to review (optional, on your own API key)
Security tools that need access to your code	Scans run in your pipeline; only results and SBOMs reach Leavory

See Leavory in action.

Tell us which platform you use, and an engineer, not a sales bot, will reach out to schedule a demo.

Risk, context, and the fix, in one place.

01 · VisibilityYour whole estate,in one view.

Audit-ready by default

For developers

For managers

OWASP Top 10, ready to add

Catches CVEs disclosed after you ship

Covers the images you didn’t build

One alert, only when it got worse

02 · IntelligenceFrom a new CVE to the fix.

Your AI key, your data terms

AI is opt-in

Fixes that fit in a coffee break

What changes when Leavory is in place.

See Leavory in action.

01 · VisibilityYour whole estate,
in one view.