Flare · Free tool by Kris McCabe
Flare checks the libraries most AI applications actually depend on for live, high-severity advisories — plus the OWASP LLM Top 10 as a permanent reference for the risks that never show up as a CVE at all.
Share this exact package list with your team via a link — no account or login needed. Anyone who opens the link sees the same live stack and can add or remove packages for everyone; changes sync automatically within about 20 seconds.
Anyone holding this link has full access to view and edit this shared list — the link itself is the access control, the same trust model as an unlisted document link. There's no per-person login, so don't post it somewhere public. Regenerate the link any time to cut off anyone still holding the old one. Teams untouched for 90 days are automatically deleted.
Upload requirements.txt, package-lock.json, pyproject.toml, or a CycloneDX/SPDX JSON SBOM — Flare selects whichever AI-stack packages below are actually in it, instead of you clicking through by hand.
Parsed entirely in your browser — the file itself is never sent anywhere. Only matches against Flare's curated AI-stack list are auto-selected below; this isn't a general dependency scanner, so the rest of your file is left alone.
Pre-selected based on the deployment pattern you told AI-SHIELD you use — adjust anytime.
Looking up a custom package sends its name to OSV.dev from your browser. Nothing else leaves this page.
Loading the advisory snapshot…
Every package Flare watches — not just the ones in your stack above. Darker cells mean more advisories at that severity, right now. Click a package to see its advisories.
Loading the advisory snapshot…
These are enduring risk categories, not news — they don't go stale the way a live advisory list does. Each one is flagged for whether it typically shows up as a CVE against a package you can patch, or as a property of how your application is built.