Hand it a jar, a fat-jar or a dependency list; it tells you which advisories actually land on you, and the single version that clears all of them at once.
This is the thing I have already shipped eight times - log4j, Jackson, Shiro, Tomcat, fastjson, pac4j, Bouncy Castle and Spring Cloud Config. Every one of them is public, tested, and verified against real artifacts: github.com/xiaoqiMikko
WHY A CUSTOM TOOL RATHER THAN A GENERIC SCANNER
Generic scanners report by coordinate. Real deployments hide versions inside fat-jars, shade dependencies, split one library across modules, and ship advisories whose fixed version was never published to the public repository. Each of those cost me a real bug to learn, and each one is handled in the repos above.
A few concrete numbers from those repos:
- log4j-check: 93 unit tests, 17 assertions, verified against 12 real-world jar scenarios
- shiro-check: 26 advisories expanded into 37 rules across 7 modules
- pac4j-check: backtested against all 147 published versions; matches the official ranges exactly, and that check runs in CI
WHAT YOU RECEIVE
- a zero-dependency Java CLI, plus source and unit tests
- a run against your actual jars, output attached
- fixes for anything inside the agreed scope, free, no cap on rounds
PRICING - the listed price is the Basic tier
- Basic, $250, 3 days: one component, version-range judgement with unit tests.
- Standard, $550, 5 days: multi-module judgement, fat-jar scanning, verification against real artifacts.
- Premium, $1000, 5 days: the above, plus applicability filtering - reading configuration or source to decide whether the vulnerable path is actually reachable.
Message me before ordering Standard or Premium and I will set up a custom offer.
WHAT I NEED FROM YOU
The component name, or one jar. If your stack has a component none of the eight above cover, I build the same thing for it.
