Free 4DA finds every version-confirmed vulnerability across the projects on your machine and names the version that fixes it. Signal turns those findings into an ordered Upgrade Plan, adds the full Preemption worklist, and keeps your full history.
Dependabot, OSV-Scanner and npm audit give individual developers vulnerability alerts for free, and so does 4DA. No trial. No account. No expiration.
Everything below runs on your machine, reads the same lockfiles as the free tier, and uses your own API key wherever an AI model is involved.
Twelve findings across five repositories are twelve tabs of advisories. The Upgrade Plan collapses them into steps, one per package, most actionable first: the version that clears every advisory on it, per release line, with major-version jumps flagged. When the vulnerable copy is transitive, it names the parent package that brings it in and, where one of your own projects already resolved a newer parent, which version of it clears the advisory. Where the lockfile records the requirement, it says when a lockfile refresh is enough.
The free tier shows the findings OSV confirms against your installed versions. Signal adds the rest of the Preemption worklist: findings an AI model has assessed against your stack, and early-warning chains assembled from releases and discussions about the packages you depend on. Each one says how confident it is and why.
The free tier keeps the last 30 days. Signal keeps everything, and adds standing queries and package watches that check new items against what you asked to follow.
Supporting views over the same inventory: the dependencies you rely on but have no coverage of (with an optional AI assessment), and the dependencies with upstream changes you have not engaged with.
Signal runs on your machine. Your lockfiles, your history, your Developer DNA, your Knowledge Gaps — none of it touches our servers. The license key is the only thing Signal sends to us: to 4da.ai when a subscription renews near expiry, and your email only if you ask to recover a lost key. Keygen, our licence provider, receives the key to validate it. Dependency checks send package names and versions to OSV.dev and the package registries, never to us.
AI features use your own API keys (BYOK). Anthropic, OpenAI, or Ollama for fully local inference. We never see your prompts. We never see the responses. We are architecturally unable to access your data.
Cancel your subscription and your data stays. Your history, your Developer DNA, everything 4DA has gathered — all of it remains on your machine. We unlock the planning and analysis views. The data is always yours.
Cargo.lock, package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, requirements.txt and go.mod, with early Gemfile.lock and composer.lock support. Exact installed versions, direct and transitive, stored in SQLite on your machine.
Advisories come from OSV.dev; package names go out, your code never does. A finding is raised only when your installed version is inside the affected range, and it is scoped by dev-only, transitive and per-platform reachability.
Findings grouped per package, ranked, and joined with your dependency edges to name the parent upgrade or lockfile refresh. Deterministic: no AI model decides a plan step.
Every vulnerability and its fix stays free. Signal is for developers who want the upgrade work planned for them.
All prices in AUD, tax included — checkout shows your local currency. Cancel anytime. Your data stays on your machine; the app sends 4DA's server only your licence key (a cloud model, if you use one, sees only what you send it).