For engineering teams
Every direct dependency you ship on, ranked by what will strand your team.
The free audit scores the repositories you have published. Your risk is in the code you depend on. We resolve every direct dependency of one repository to the project that actually publishes it, score bus factor and dormancy, and hand you the ranked list — in two business days.
What the report actually says
Not a dashboard. A ranked list, with the evidence attached.
$ dependency-risk assess --manifest package.json
Scanned 28 direct dependencies · 3 at risk
→ 3 of your 28 direct dependencies are maintained by one person or have not shipped in over a year.
CRITICAL some-dep — single maintainer, last commit 19 months ago
CRITICAL another-dep — no commits in 14 months, 0 open issues
HIGH third-dep — bus factor 1, maintainer has 2 other projects
Each finding carries the resolution we used, the last commit date, and the maintainer count — so every line is checkable by you, not just by us.
Shown for a representative Node repository. Your numbers come from your manifest.
Why your dependencies, not your repositories
Your repos are not the risk
You already maintain those. They have you. Auditing them tells you what you already know.
Your dependencies are the risk
A transitive package with one maintainer and no commits in a year is a future incident with your name on the ticket. You find out from a customer, or from our report first.
The resolution is the hard part
Package names do not point at repositories. We resolve through the authoritative registry and verify the publisher — so a finding is never a name that merely looks similar.
What is included
Per repository
$2,500
Larger dependency estates are scoped between $2,500 and $7,500. You get the quote before anything is committed — there is no auto-renewal.
Who does this work, and where are we
BreakPoint is a small, early company. This is done by the founder, not passed to a services team, and you talk to the person who ran the scan. There is no logo wall and no case-study page, because there are no previous clients yet — we would rather tell you that than imply otherwise.
What that means practically: you get a named person, a scoped price agreed before any work starts, and a direct line if a finding is wrong. What it does not mean: we are a large vendor with a support desk behind you. If that trade is not right for your team, the free audit below is genuinely free and we would rather you used it.
Not ready to scope an engagement?
Most people are not, on first contact. Get the monthly note instead — real abandoned-dependency findings, and an email when a tool that fits your stack is ready. No sales sequence, unsubscribe in one click.
Questions we get first
Why not just use the free audit?
The free audit at /audit scores the public repositories an organisation has published — their outbound open source. This scores the dependencies they ship, which is where the operational risk sits.
Do you need access to our private code?
No. A public manifest — package.json, lockfile, go.mod, requirements.txt — is enough. If you would rather not publish one, a redacted dependency list works.
How fast?
Resolution and scoring within two business days of receiving the manifest. The findings call is booked the week after, so you have the report before you brief anyone.
Is this a subscription?
No. It is one-time work, invoiced once the scope is agreed, and it does not renew. If you want the same scoring run again later as your dependencies move, ask and we will quote it as a second engagement rather than a plan.
Request an assessment
A person replies within one business day with a scoped quote. No card, no auto-renewal, and nothing is committed before you approve it.