Bring us your public repo. 30 minutes later you'll have pull requests for anything we can fix. Keep them whether you buy Kusari or not.
Pick a public repository you're responsible for. No slides.
On our Repo Review, we’ll run Kusari on a public repo of yours, live, and you watch it happen.
First it resolves the dependency tree, including the parts your manifest never declares: transitive packages, pinned commits, and vendored code that never announced itself. That’s the part of your graph that’s been reporting clean because nothing ever looked.
Then we sort what’s affected from what isn’t. Any finding whose vulnerable code path your application never calls comes off the list, with a stated reason attached that you could put in front of an auditor.
At the health insurer we work with, that took around 90% off the active list. What’s left gets ranked by Kusari Score, which is built on what’s exploitable in your environment rather than on CVSS severity alone.
If you want us to, we’ll open pull requests against your repositories for anything currently open and fixable, inside that same thirty minutes. You review them, and whether they get merged is your call.
So the worst case is that you spend half an hour and leave with open pull requests against your own code that you didn’t have when you started.
Ranking findings is the easy part. Defending the ranking is the hard part, and in our conversations with security leaders, that’s usually what’s missing.
Public repos only. Nothing to install, nothing to procure, no access to grant.
Open pull requests against your own repository, rather than a report or a walkthrough of somebody else’s demo environment. They’re yours to keep.
Your scanner reads the manifest, a declaration of what the software is supposed to contain, and it takes its word for everything below it. But that’s where 95% of open source vulnerabilities live — in transitive dependencies that nobody chose deliberately.
The reasoning behind every ranking is visible and you can feel comfortable sharing with your teams and leadership.
A security leader at a national health insurer told us the last thing they wanted was another Shai-Hulud without Kusari in place. On August 4, Mini Shai-Hulud moved through npm.
Most of the teams we spoke to that week were still working out whether they had it and where. That team answered it in seconds, because their dependency graph is built from source rather than read back from a manifest.
Click through the platform yourself. No form, no call.
We run Kusari on a public repository you’re responsible for, live. It resolves the dependency tree past the layer your scanner reads, sorts what’s genuinely affected from what isn’t, and ranks what’s left by Kusari Score.
If you want us to, we’ll open pull requests for anything currently open and fixable before the thirty minutes is up, and you keep those whether or not you decide to keep talking to us.
We only need your public repo link for this review, so there’s nothing to ship off and nothing you need to procure. For the platform itself, Kusari connects to your GitHub or GitLab repository and builds the full picture from there. We don’t store your code.
No. It opens pull requests and each one goes through the same reachability and exploitability analysis as the findings. CI test run against the change before it reaches you. Reviewing, merging, and pushing fixes stay with you.
No, Kusari is not a scanner and does not need to replace the ones you have installed. Scanners read your manifest and check what it declares against a vulnerability feed, but Kusari resolves the dependency graph from source, so it sees below what the manifest declared.
There will be fewer false positives. Reachability analysis checks whether your application ever calls the vulnerable code. If it doesn’t the finding comes off the active list and the reason goes on the record. At one of our health insurer customers, that cleared about 90% of the queue. Nothing gets deleted. If an auditor asks about a specific CVE a year down the road, the finding is still there, along with why it came off.