Start free, upgrade when you need more. No credit card required for the free tier.
Track a full repo, free forever: a frontend and a backend lockfile, agent included.
Every project you work on: unlimited lockfiles and sources, all notification frequencies.
Includes 5 seats · extra seats €12/month
The org audit workspace: the whole team sees the same sources, lockfiles, and security issues, and every seat's agent gets the same verified answers.
On the roadmap
Not built yet. Tap the ones you want — we prioritize the roadmap by what gets the most taps.
All prices are net. VAT or sales tax may be added at checkout depending on your location.
Your subscription remains active until the end of your current billing period. After that, you'll be downgraded to the Hobbyist tier. Your data is preserved, but you'll be subject to free tier limits.
Yes. Under the EU 14-day right of withdrawal, you can cancel your initial subscription within 14 days of purchase and receive a pro-rata refund for the unused part of your billing period: refund = payment × (1 − days elapsed ÷ days in period). Withdraw on day 0 and you get 100 % back. You can see the exact amount in Settings → Subscription → Request Refund before confirming. Renewals are non-refundable, and we offer a free Hobbyist tier so you can evaluate the service first.
The Team plan includes 5 seats for €59/month (or €588/year billed annually). Need more seats? Add seats anytime at €12/month or €120/year per seat. Extra seats follow your plan's billing cadence as part of one subscription price. Added seats take effect immediately with a prorated charge; removed seats stay usable until the end of your current billing period.
Everything the Team card lists with a checkmark is live today: everything in Professional, 5 shared seats, team member management, Customer Success, and the shared workspace itself, where the whole team sees the same sources, lockfiles, and security issues and every seat's agent reads the same verified MCP data. A few team features are still ahead of us, shown in the "On the roadmap" box on the card: collaborative source watching (a shared watch workflow on top of the team-wide sources you already get), shared audit reports, CI/CD integration, and a team review dashboard. They aren't built yet, so we don't bill for them; tap "I want this" on any of them to register your interest and help us prioritize what we build next. Your Team price reflects what's live today, and roadmap features arrive as part of the plan at no extra cost when they land.
No metering, no credits, no wallets: a plan is a flat price for the features it lists. Tiers differ by the things you can count: lockfiles, tracked sources, and seats; every tier (including free) gets the MCP server, agent skills, and the security audit (on each lockfile's dashboard page and to your agents over MCP). AI-powered analysis (release summaries, diff analysis, digests) is included, subject to a fair-use policy that only matters at genuinely unusual volumes. If you ever approach it, processing is briefly queued rather than billed.
Yes! You can upgrade or downgrade at any time. When upgrading, you'll be charged the prorated amount. When downgrading, the change takes effect at the end of your billing period.
We use PayPro Global as our payment processor, which supports all major credit cards, PayPal, and various local payment methods depending on your region.
All displayed prices are net prices excluding VAT or sales tax. Applicable taxes will be calculated and added at checkout based on your location. PayPro Global, as our Merchant of Record, handles all tax compliance automatically.
Yes! Annual plans save you money compared to monthly billing. Professional is €6/month (€72/year) instead of €8/month, 25% off. Team is €49/month (€588/year) instead of €59/month, about 17% off. Annual plans are billed upfront for the full year.
Partly, yes, and we lean into it: our agent skills are free downloads, and even the free tier includes the full MCP server. In one session an agent can re-derive a one-off audit from the registries and the OSV database. What a one-shot run can't be is continuous (we recompute every monitored pin against new advisories daily and alert you between sessions), cheap at scale (we compute release intelligence once per release and share it across every user, instead of re-paying full token cost per run), or diff-grounded (undocumented breaking changes come from reading the actual code diff of every release, a batch job, not a chat turn). The docs have the full honest version of this argument under "Can't my agent just do this?".
No, and we don't try to: it's a complement, by design. Every security issue we raise carries the OSV/GHSA advisory id and fix version, checked against your exact pinned version, so npm audit confirms each one id-for-id rather than contradicting us. Where the two differ, npm audit finds more, not different: it walks every nested copy in your install tree, so it catches advisories against a second copy of a package pinned at a version we don't track (we match one resolved version per package name). We name that gap for you, as a "shadowed duplicate versions" count in the audit rollup, and point you at the registry audit to close it. What is not a gap: dependencies you haven't selected for release tracking. An advisory match needs only the ecosystem, name, and version, so the audit covers every pinned dependency in the lockfile whether or not we discovered a source for it — selecting a package adds release notes, risk scoring, and upgrades on top. So run npm audit too, for the full-tree sweep; DevUpdate tells you where it stops.
Have more questions?