About cupel

Why cupel Exists

Security advisories name a package and a range of versions — for npm, almost never the function that’s actually vulnerable. So package-level alerting flags every dependency that matches, whether or not your code ever calls the vulnerable function. Real risk hides among alerts that don’t apply to you, and triage quietly becomes someone’s job.

cupel starts from a different premise: a security tool earns trust by being precise about what it knows and honest about what it doesn’t. Every finding ends in a verdict — reachable, not reachable, or an honest unknown — with the call path and a confidence tier behind it, so you act on evidence instead of a queue.

Principles

• Never a false clean. cupel never reports safe when it can’t prove safe. A fabricated clean is the one unforgivable error a security tool can make.
• unknown is an answer. When the analysis can’t resolve a path — a dynamic import, reflection — cupel says so and shows the exact hop it couldn’t resolve, instead of guessing either way.
• Your code stays yours. The scan runs locally; code never uploads, on any tier. Findings sync to your dashboard, and the enterprise tier is fully zero-egress.
• Evidence over scores. Every verdict carries the call path behind it and a confidence tier you can audit — not an opaque severity number.
• No fear marketing. cupel never publishes a number it didn’t measure and never sells with dread. The same rule binds this site.

Where cupel Comes From

cupel started with a tempo problem. Vulnerability disclosure is accelerating: NIST reports that CVE submissions grew 263% between 2020 and 2025 — and says it does not expect the trend to let up — while FIRST’s mid-2026 forecast projects roughly 66,000 CVEs this year and names AI-assisted vulnerability discovery among the structural drivers. Every one of those advisories lands in somebody’s triage queue.

The same forecasters add the part that matters: filtered for real-world exploitability, the patching burden has stayed roughly flat. More advisories, not proportionally more risk — the work is telling the two apart, and package-level alerting cannot do it. That is exactly what reachability analysis is for.

And that analysis exists — mostly inside enterprise platforms. Socket’s documentation states that full-application, function-level reachability requires an enterprise plan; Endor Labs quotes no price on its own site, and its marketplace list rate works out to about $1,296 per developer per year (mid-2026). Lighter checks exist cheaper — but the whole-application, call-graph kind has mostly shipped at enterprise price points or behind a sales call.

cupel exists to close that gap: honest, evidence-backed reachability verdicts — reachable, not reachable, or an honest unknown — accessible to ordinary engineering teams, not only enterprise budgets.

The Name

A cupel is the small bone-ash vessel assayers have used for roughly three millennia to prove precious metal: under fire, base metals oxidize and soak away into the porous cup, and what remains on top is a bead of pure gold. That is the product’s thesis in one object — burn off the noise, keep what proves out — and it’s why the u of the wordmark holds a single gold bead. Pronounced KYOO-pul; written lowercase, always, because cupel is a shell command and the wordmark follows the command.

Contact

cupel is in private testing. Request a demo to see it on a real project, or reach the team on GitHub.