VersionEye review
A low-cost option for file-based dependency vulnerability and license scans.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
VersionEye scans dependency-manager files for known vulnerabilities, outdated versions, and open-source license violations. It is aimed at developers and businesses managing dependencies across projects, particularly small teams that want file-based scanning without per-user pricing. The service is cloud-deployed and available through web and API interfaces, with support for Python, Ruby, Node.js, and PHP ecosystems, including npm, Composer, Bundler, and pip.
Pricing is usage-based. The Pay per use plan costs €1 per file scan per month and includes the first 5 scans free, with unlimited users. The Subscription plan costs €50 per month and includes 200 file scans and unlimited users. Both plans center on scanning dependency files rather than charging by seat. The product also provides HTTP API access for submitting dependency files and retrieving reports, plus configurable email and SMS notifications. Teams that scan a limited number of files may find the pay-per-use structure easier to align with project volume, while recurring scanning across many files is better matched to the subscription tier.
VersionEye covers several practical dependency-management tasks: vulnerability checking, license whitelist and violation detection, outdated-version notifications, API-based reporting, and CI/CD build breaking when issues are detected. Its narrower ecosystem coverage and absence of SBOM generation, reachability analysis, and pull-request scanning limit its fit for teams seeking broader application security workflows. Choose VersionEye when low-cost file scanning, license oversight, and build checks are the priority. Teams requiring deeper software composition analysis coverage or pull-request-focused processes should consider an alternative with those capabilities.
VersionEye pros and cons
- Where it wins
- Checks vulnerabilities against multiple security databases
- Detects license violations and supports open-source license whitelists
- CI/CD integrations can break builds when issues are detected
- Where it doesn't
- Supports a narrower set of dependency ecosystems
- Does not generate SBOMs or perform reachability analysis
- Does not offer pull-request scanning
VersionEye fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update