BREACHLINE / OPEN TOOLKIT
Free Supply Chain & Security Tools
The dependencies you install. The changes you merge. The settings you forget. Take a closer look, with free tools built for everyday security work.
Trust starts with
knowing what you ship.
THE TOOLKIT
Find the right check.
Search by task, technology, or file format.
Every tool explains its limits. Local reviews stay on your device; online lookups and optional AI explain what is sent.
Supply chain
Open folderrequirements.txt
Python requirements review
Review Python dependency pins, local hash declarations, package indexes, editable sources, and transport settings.
CycloneDX / SPDX JSON
SBOM comparison
Compare software inventories across builds. Find added or removed components and changes to license or digest metadata.
package.json / npm lockfile
Dependency review
Look beyond the version number. Review install scripts, dependency sources, version ranges, and lockfile integrity metadata.
npm lockfile v2 / v3
Lockfile diff
See what a dependency update really changed. Compare versions, download sources, integrity hashes, and installation hooks.
CycloneDX / SPDX JSON
SBOM explorer
Make your software inventory readable. Inspect components, versions, licenses, package identifiers, and missing metadata.
.npmrc
npm configuration review
Catch the quiet configuration risks: insecure registries, disabled TLS checks, and credentials with overly broad scope.
Any file / text
Integrity hash generator
Generate SHA-256, SHA-384, and SHA-512 integrity strings from a local file or text. Keep the bytes in your browser.
CI and build security
Open folderGitHub Actions YAML
GitHub Actions review
Review workflow permissions, action pinning, privileged triggers, and untrusted expressions before they reach your build.
Dockerfile
Dockerfile review
Check base-image references, runtime user declarations, installation patterns, and secret-bearing build settings.
Application security
Open folderChrome / Firefox manifest.json
Browser extension review
Review extension permissions, injected scripts and messaging boundaries. Import a Chrome Web Store link or paste a Chrome or Firefox manifest.
JavaScript / ES modules
JavaScript review
Inspect JavaScript syntax for dynamic execution, HTML injection sinks, message handling, and sensitive storage patterns.
JWT
JWT inspector
Decode token headers and claims. Inspect expiry, declared algorithms, and key references without sending the token anywhere.
Pasted HTTP response headers
Security header review
Turn HTTP response headers into a practical review of browser protections, with notes on what needs closer attention.
Absolute URL
URL inspector
Unpack a link before you open it. Review its scheme, hostname, embedded credentials, and encoding-related signals locally.
AI and agent security
Open folderNetwork and domains
Open folderExplore
Supply chain
Lockfiles, SBOMs and registries.
Supply chain toolsCI and build security
GitHub Actions and Dockerfiles.
CI and build securityApplication security
JWTs, headers, JavaScript and URLs.
Application security toolsAI and agent security
Skill review and the MCP server.
AI and agent securityNot a penetration test
A scoped service is quoted separately.
Penetration testing services
GO DEEPER
Follow the evidence.
Walk through a supply-chain review with sample lockfiles, screenshots, observed results, and a configuration retest.