What is Vectana?
Vectana watches the packages and runtimes your projects use for vulnerabilities and end of life, and notifies you by email, Discord or Slack.
Vectana watches the packages and runtimes your projects use for vulnerabilities and end of life (EOL), and tells you when something needs attention.
“A library just got a CVE — which of our projects use it?” “How long is this Python version supported?” Vectana answers both, across all your projects, in one place.
What it does
Vulnerability detection
Checks the versions you register against OSV and shows the affected advisories and the fixed versions.
End-of-life detection
Checks support dates for frameworks, languages, databases and operating systems with endoflife.date.
Import lockfiles and mise.toml
Drop package-lock.json, uv.lock, pubspec.lock, mise.toml and more to register everything at once.
Email, Discord and Slack
New findings are bundled into one digest per recipient and sent to project members and team channels.
Companies, departments and partners
Model group companies, departments and partner (BP) companies, and control who sees which projects.
Self-hostable
Runs with Docker Compose. The source code is available under AGPL-3.0.
How it works
- Create a project and register the packages (lockfiles) and runtimes (languages, databases, OS…) it uses
- Vectana asks OSV and endoflife.date about each of them
- New vulnerabilities and EOL changes are sent as a digest by email and webhook
- From then on, everything is re-checked periodically (every 6 hours by default)
Where to start
- New users: Logging in → Dashboard → Projects
- Administrators: Organization → Users and permissions
- Running your own server: Installation
The app is available in Japanese and English. You can switch this documentation’s language at the top right.