see it in action · real output

bumper, run against real code — and itself.

These are bumper's own scans — a destructive Terraform plan, crafted and real anonymized lockfiles across npm, Python, Rust, and Go, plus bumper scanning its own dependencies. Every finding is real, checked live against the hosted Advisor and regenerated by the self-scan workflow · as of Jul 20, 2026.

verify on GitHub:self-scan workflow·published artifact·reports.json

Terraform plan safety

a destructive + exposing AWS apply

3findings
2critical
1high
  • criticalThis apply will DESTROY and recreate a database with no final snapshotaws_db_instance.orders · AWS_DB_DESTRUCTIVE_REPLACE_NO_SNAPSHOT
  • criticalSecurity group allows public internet ingress (0.0.0.0/0 or ::/0) to a sensitive or wide port rangeaws_security_group.api · AWS_SG_PUBLIC_INGRESS
  • highThis apply will DELETE or REPLACE a stateful data resource (potential data loss)aws_db_instance.orders · AWS_STATEFUL_RESOURCE_DESTROY
command
bumper plan.json
GitHub Action
- uses: gnana997/bumper@v1
  with:
    plan-json: plan.json

npm — crafted sample

vulnerable + a malicious package

npm
4scanned
4vulnerable
1malicious
  • maliciousflatmap-stream@0.1.1 MAL-2025-20690remove immediately
  • criticalevent-stream@3.3.6 GHSA-mh6f-8j2x-4483fix → 4.0.0
  • criticalflatmap-stream@0.1.1 GHSA-9x64-5r7x-2q53no fix yet
  • criticalflatmap-stream@0.1.1 GHSA-mh6f-8j2x-4483no fix yet
  • criticallodash@4.17.4 CVE-2019-10744fix → 4.17.12
+9 more
command
bumper deps package-lock.json
GitHub Action
- uses: gnana997/bumper/deps@v1

Python — crafted sample

known CVEs (requirements.txt)

PyPI
4scanned
4vulnerable
0malicious
  • criticaldjango@2.2.0 CVE-2022-28346fix → 2.2.28
  • criticaldjango@2.2.0 CVE-2019-14234fix → 2.2.4
  • criticaldjango@2.2.0 CVE-2025-64459fix → 4.2.26
  • criticaldjango@2.2.0 CVE-2020-7471fix → 2.2.10
  • criticaldjango@2.2.0 CVE-2019-19844fix → 2.2.9
+50 more
command
bumper deps requirements.txt
GitHub Action
- uses: gnana997/bumper/deps@v1

npm — real-world project

anonymized lockfile, full dependency tree

npm
790scanned
46vulnerable
0malicious
  • critical@babel/traverse@7.13.13 CVE-2023-45133fix → 7.23.2
  • criticalform-data@2.3.3 CVE-2025-7783fix → 2.5.4
  • criticaljson-schema@0.2.3 CVE-2021-3918fix → 0.4.0
  • criticalminimist@1.2.5 CVE-2021-44906fix → 1.2.6
  • high@babel/plugin-transform-modules-systemjs@7.13.8 CVE-2026-44728fix → 7.29.4
+55 more
command
bumper deps package-lock.json
GitHub Action
- uses: gnana997/bumper/deps@v1

Python (uv) — real-world project

anonymized uv.lock, full dependency tree

PyPI
451scanned
23vulnerable
0malicious
  • criticalvllm@0.20.2 CVE-2026-48746fix → 0.22.0
  • highclick@8.1.8 CVE-2026-7246fix → 8.3.3
  • highcryptography@48.0.0 GHSA-537c-gmf6-5ccffix → 48.0.1
  • highgradio@6.8.0 CVE-2026-48545fix → 6.15.0
  • highgradio@6.8.0 CVE-2026-49119fix → 6.16.0
+70 more
command
bumper deps uv.lock
GitHub Action
- uses: gnana997/bumper/deps@v1

Rust — real-world project

anonymized Cargo.lock, full dependency tree

crates.io
66scanned
4vulnerable
0malicious
  • highcrossbeam-utils@0.8.5 CVE-2022-23639fix → 0.8.7
  • highregex@1.5.4 CVE-2022-24713fix → 1.5.5
  • highthread_local@1.1.3 GHSA-9hpw-r23r-xgm5fix → 1.1.4
  • lowatty@0.2.14 GHSA-g98v-hv3f-hcfrno fix yet
command
bumper deps Cargo.lock
GitHub Action
- uses: gnana997/bumper/deps@v1
✓

Go — bumper's own dependencies

dogfood: bumper scans itself — scanned 48 dependencies, no known vulnerabilities or malicious packages.

command
bumper deps go.sum
GitHub Action
- uses: gnana997/bumper/deps@v1
FAQ

Questions, answered

Are these real scan results or marketing samples?

They are real bumper output, regenerated daily by the open-source self-scan GitHub workflow and checked live against the hosted Advisor. You can verify every finding yourself — the workflow, the published artifact, and the raw reports.json are all linked at the top of this page.

What does bumper actually catch?

Two changes you cannot take back: a destructive or exposing Terraform apply (deletes, replacements, newly public access), and vulnerable or known-malicious dependencies across npm, Python, Rust, and Go. The showcase even includes bumper scanning its own dependencies.

How do I run the same checks on my own repo?

Add the bumper GitHub Action to gate Terraform plans and dependency installs on every pull request, or run the free scanner on a lockfile right now. The same deterministic engine powers the CLI, the CI Action, the agent guardrail, and the Advisor MCP.

wire it in

Add the same gate to your repo in two lines.

Drop the GitHub Action into your workflow to gate Terraform plans and dependency installs on every PR, or run the free scanner on a lockfile right now. The same engine powers the agent guardrail and the Advisor MCP.