Dependency Health & Security for Windows
See what your dependencies are really doing.
Depcura is an offline-first Windows desktop app for dependency health and security. Open a project folder, scan it locally, and review each finding with a clear next step. No account. No subscription.
Get Depcura on Microsoft StoreSee the walkthrough
- Version 1.0.0
- Windows 10/11 x64
- One-time purchase
Product walkthrough
Six genuine screens. Nothing reconstructed.
Captures from the release 1.0.0 image set showing a real scan with 7 findings. Use the tabs or Previous / Next. Every caption comes from the release evidence.
Review health from one dashboard
Review project dependency health, findings and scan history from one clear dashboard.
Scan a folder you choose
Scan a selected project locally using configurable depth, file and manifest limits.
Prioritise by severity and package
Prioritise dependency findings by severity, package and ecosystem with clear remediation guidance.
Preview before anything changes
Preview supported changes, create local backups and retain rollback control.
Export for review
Export clear dependency reports in JSON, CSV and PDF formats. PDF auto-rendering still needs on-device verification.
Ask for help without leaking paths
Copy or save a privacy-conscious diagnostic summary when requesting support.
How scanning works
Your folder never leaves your PC unless you say so.
Bounded local discovery
Depcura walks the folder you select, skips dependency and build directories, and enforces depth, file-count and file-size limits. A junction cycle back to the scan root is detected and terminates. Scanning is read-only; the UI never executes shell commands.
Deterministic score, kept local
Findings feed a documented deterministic score. Scan reports persist in a local SQLite store with summary listing, full retrieval and deletion. Cancelled scans persist nothing; a restart leaves no stale in-progress scans.
What release 1.0.0 does
Findings, action plan, safe change, exports.
Findings you can act on
Offline rules flag version conflicts, duplicate resolved versions, missing lockfiles, manifest/lockfile mismatch, unpinned or wildcard constraints, pre-releases, missing integrity data, licence-policy gaps, toolchain issues and maintenance signals. Undeterminable advisory severity stays Unknown, shown as Info — never silently upgraded.
Safe change, not silent edits
Supported changes show a preview diff, create a local backup, apply atomically, validate the result and roll back on failure. You can also roll back manually afterwards. Invalid JSON and TOML are rejected before anything is written.
Reports that match the screen
One canonical report model renders JSON, CSV (RFC 4180 with formula-injection guard) and self-contained HTML with path redaction on by default. PDF orchestration validates, temp-stages and cleans up; automatic WebView2 rendering still needs on-device verification, with a native print-dialog fallback.
Ecosystems
Eight ecosystems parsed. Analysis depth varies.
Parsing manifests and lockfiles is verified across Node.js, Python, Rust, .NET, Go, Java/Kotlin, PHP and Ruby. Ecosystem-specific analysis (advisory coverage, version comparison, deprecation signals) and safe-change support are narrower — see the matrix before assuming equivalence.
Online enrichment is optional
OFF until you choose otherwise.
Three consent modes: OFF (default, no request ever issued), CHECK ONCE (authorises exactly one operation, then reverts to OFF), ALWAYS (until you revoke). Revocation takes effect before any new request.
When you consent, Depcura sends package coordinates — ecosystem, package name and exact resolved version — to the official advisory/registry source for that lookup, plus ordinary TLS network metadata. Unresolved constraints are never submitted as installed versions. Redirects are disabled.
What stays local
- Source code, file contents, file paths and repository remotes are not transmitted.
- Usernames, machine identifiers and personal data are not transmitted.
- Lookup results cache locally (OSV 12h, registry 24h) and can be cleared in the app.
- The app frontend cannot supply URLs — endpoints are backend-controlled and allowlisted.