Which advisories can your code actually reach?

  • reachable
  • not-reachable
  • potentially reachable

cupel traces call paths from a dependency's advisory into your source. Every finding gets one of three verdicts, and potentially reachable is one of them — never folded into the others to make a number look better.

  1. 01Sign in and connect a repository
  2. 02cupel resolves your dependency graph and traces reachability
  3. 03Triage by what the evidence supports

Sign in to cupel

Use the GitHub account that owns the repositories you want scanned.

Sign in with GitHub Sign in with Google Sign in with GitLab

cupel asks GitHub, Google or GitLab for your verified email address and your name, and nothing else. No sign-in grants access to your repositories.

or

Forgot password

An organisation appears when you install the cupel GitHub App on an account, or you can make one yourself and connect repositories later. Your session lives in a cookie scoped to this site alone.