Transparency
Real, aggregate numbers about what PackageSafe has actually done - not vanity metrics, and nothing fabricated. If a number below is zero, it's because nothing has happened yet, not because it was hidden.
Tracking since August 26, 2026 · last updated September 4, 2026
Scans performed
- Total scans
- 78
- Single package
- 75
- Dependency tree
- 2
- Repo scans
- 1
Packages seen
- Unique packages scanned
- 79
- npm
- 127
- PyPI
- 1
- Maven
- 0
Known vulnerabilities found
Via OSV.dev, across every package scanned.
- Total
- 48
- Critical
- 0
- High
- 23
- Medium
- 23
- Low
- 2
Supply-chain findings
- Heuristic findings triggered
- 40
What's tracked, and why
Same spirit as how the scoring pipeline works: nothing here should be a black box. This page is generated from a running total kept in a small database, updated once per completed scan.
Tracked, in aggregate only:
- How many scans have run, by type (single package, dependency tree, repo scan).
- How many distinct packages have been scanned, as a count.
- How many known vulnerabilities and supply-chain findings have been surfaced, by severity.
- A breakdown by ecosystem (npm/PyPI/Maven).
- All of it bucketed by day - no finer-grained timestamps are kept or shown.
Deliberately not tracked or exposed:
- No IP addresses, request origins, or any other user-identifying information - scanning doesn't require an account, and nothing here changes that.
- No list of which packages were searched, and no per-package timing or frequency. We do keep an internal set of distinct package identifiers (just the name - no timestamp, no per-package count) solely so "unique packages scanned" can be a real number instead of a guess. That set is never exposed by this page or the API, and on its own it can't answer "what was searched, when, or how often" - which is the thing we're specifically avoiding building.
The public numbers are read from GET /stats, cached for up to 5 minutes - the same endpoint this page renders.