Dual-Engine Dependency Scanning
One vulnerability database is a single point of failure. The Immortal Defender runs grype and trivy side by side, cross-validates their findings, and keeps every unique catch — so your dependencies are checked against the union of the world's advisory databases.
grype
Advisory-Breadth Engine
Anchore grype resolves your dependency tree against GitHub Security Advisories plus the Alpine, Red Hat, Debian, Ubuntu, Amazon, and Oracle advisory databases. Its strength is breadth: distro-specific advisories that never make it into the NVD feed still get caught.
trivy
NVD-Depth Engine
Aqua trivy scans the same dependency tree against the NVD and vendor feeds with deep language-ecosystem support. Its strength is depth: precise version-range matching across npm, PyPI, Go modules, Cargo, and container base layers.
Independent Scans
Both engines scan the target independently — neither sees the other's output, so a blind spot in one database cannot suppress a finding.
Cross-Validation Merge
Findings that share the same CVE and package collapse into a single higher-confidence finding recording both engines. Agreement is signal: two independent databases confirmed the vulnerability.
Unique-Catch Preservation
A CVE only one engine knows about is kept and labeled with its source engine. Broader coverage means the union of both databases protects you, not the intersection.
Fix Guidance
Every finding carries the fixed version when one exists, so remediation is a version bump away instead of a research project.
Scan With Two Engines, Miss Nothing
Cross-validated dependency intelligence ships in every fortress.