From advisory flood to ranked exploit list in one scan
Four technical layers that turn a 280-item CVE report into a 6-item patch queue.
Entry-point discovery
Patchlynx reads your framework routing configuration to enumerate every HTTP endpoint your application exposes. It understands Express route declarations, FastAPI path operations, Spring Boot @RequestMapping, and Rails route files — parsing the actual routing logic, not just scanning file names.
Every entry point becomes a root in the call graph. Paths that are never reachable from any of these roots cannot be exploited from the network.
Static call-graph construction
Static analysis walks your call graph from each entry point through all transitive dependencies — not just the packages listed in your package.json or requirements.txt, but every package in the transitive closure. For every function call, Patchlynx traces the execution path: direct calls, indirect calls through callbacks, and promise chains.
Standard SCA tools report on what's installed. Patchlynx reports on what's reachable. The difference is the gap between 280 advisories and 6 actionable findings. If a package is never on any call path from an entry point, it's categorically unreachable regardless of its CVSS score or advisory history.
Advisory intersection
Advisories from OSV and NVD are cross-referenced against only the packages that appear on reachable call paths. A CVE in a package that never appears on any call path from an entry point is marked "unreachable" and deprioritized.
Ranked patch output
Output is a ranked list ordered by: reachability confirmed + CVSS score + fix availability + dependency depth. Engineers get exactly what they need to act: CVE ID, affected package and version, the full call path trace, and the recommended fix version. Unreachable advisories go into a separate periodic review queue — visible but not in your sprint.
The list is already triaged. This is the input to your remediation SLA workflow, not the thing you triage before creating that input. Open a ticket, attach the call path trace, run the fix, close the sprint item.
Start your first scanWorks where your code lives
Each language implementation handles its own module resolution, import semantics, and dependency graph conventions. Patchlynx reads your manifest files (npm, pip, Maven, Go modules) to build the initial dependency graph, then walks the actual call graph — not just the SBOM surface.
| Language / Ecosystem | Package Manager | Framework Detection | Status |
|---|---|---|---|
| Node.js | npm, yarn, pnpm | Express, Fastify, Koa, NestJS | Available |
| Python | pip, poetry, pipenv | FastAPI, Flask, Django | Available |
| Java | Maven, Gradle | Spring Boot, Quarkus | Available |
| Go | Go modules | net/http, Gin, Echo | Available |
| Ruby | Bundler / gems | Rails, Sinatra | Coming soon |
| Rust | Cargo / crates | Actix, Axum | Coming soon |
| PHP | Composer | Laravel, Symfony | Coming soon |