diff --git a/python-vulnerability-lookup.html b/python-vulnerability-lookup.html
new file mode 100644
index 0000000..dca0dee
--- /dev/null
+++ b/python-vulnerability-lookup.html
@@ -0,0 +1,674 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Python Vulnerability Lookup</title>
+    <style>
+        * { box-sizing: border-box; }
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+            max-width: 900px;
+            margin: 0 auto;
+            padding: 20px;
+            line-height: 1.6;
+            color: #333;
+        }
+        h1 { margin-top: 0; }
+        textarea {
+            width: 100%;
+            min-height: 200px;
+            padding: 12px;
+            border: 2px solid #ddd;
+            border-radius: 6px;
+            font-family: 'Courier New', monospace;
+            font-size: 14px;
+            resize: vertical;
+        }
+        textarea:focus {
+            outline: none;
+            border-color: #4a90e2;
+        }
+        button {
+            background-color: #0066cc;
+            color: white;
+            border: none;
+            padding: 10px 20px;
+            border-radius: 6px;
+            cursor: pointer;
+            font-size: 15px;
+            margin-top: 10px;
+        }
+        button:hover { background-color: #0052a3; }
+        button:disabled { background-color: #999; cursor: not-allowed; }
+        #fetchBtn { margin-top: 0; }
+        #status {
+            margin-top: 12px;
+            padding: 10px;
+            border-radius: 6px;
+            display: none;
+        }
+        #status.visible { display: block; }
+        #status.info { background: #e8f4fd; color: #0c5494; }
+        #status.error { background: #fef5f5; color: #c0392b; }
+        #results { margin-top: 20px; }
+        .summary {
+            padding: 14px;
+            background: #f0f0f0;
+            border-radius: 6px;
+            margin-bottom: 16px;
+            font-size: 15px;
+        }
+        .package-section {
+            border: 1px solid #ddd;
+            border-radius: 6px;
+            margin-bottom: 12px;
+            overflow: hidden;
+        }
+        .package-header {
+            padding: 12px 16px;
+            font-weight: 600;
+            font-size: 15px;
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            flex-wrap: wrap;
+        }
+        .package-header.has-vulns { background: #fff5f5; border-bottom: 1px solid #ddd; }
+        .package-header.clean { background: #f0faf0; }
+        .version-tag {
+            font-weight: normal;
+            font-size: 13px;
+            color: #666;
+            background: #e8e8e8;
+            padding: 2px 8px;
+            border-radius: 4px;
+        }
+        .vuln-count {
+            margin-left: auto;
+            font-size: 13px;
+            color: #c0392b;
+            font-weight: normal;
+        }
+        .vuln-item {
+            padding: 12px 16px;
+            border-top: 1px solid #eee;
+        }
+        .vuln-item:first-child { border-top: none; }
+        .vuln-title {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            flex-wrap: wrap;
+            margin-bottom: 4px;
+        }
+        .severity-badge {
+            font-size: 11px;
+            font-weight: 700;
+            padding: 2px 8px;
+            border-radius: 4px;
+            text-transform: uppercase;
+            letter-spacing: 0.3px;
+        }
+        .severity-critical { background: #dc3545; color: white; }
+        .severity-high { background: #e8740c; color: white; }
+        .severity-moderate { background: #f0ad4e; color: #333; }
+        .severity-low { background: #5bc0de; color: #333; }
+        .severity-unknown { background: #999; color: white; }
+        .vuln-id a {
+            font-family: monospace;
+            font-size: 14px;
+            color: #0066cc;
+            text-decoration: none;
+        }
+        .vuln-id a:hover { text-decoration: underline; }
+        .vuln-summary {
+            margin: 4px 0 0;
+            font-size: 14px;
+            color: #555;
+        }
+        .vuln-aliases {
+            font-size: 13px;
+            color: #777;
+            margin-top: 2px;
+        }
+        .vuln-affected {
+            font-size: 13px;
+            color: #666;
+            margin-top: 4px;
+        }
+        details.raw-json {
+            margin-top: 8px;
+        }
+        details.raw-json summary {
+            cursor: pointer;
+            font-size: 13px;
+            color: #666;
+            user-select: none;
+        }
+        details.raw-json summary:hover { color: #333; }
+        .json-container {
+            position: relative;
+            margin-top: 6px;
+        }
+        .json-container pre {
+            background: #f6f8fa;
+            border: 1px solid #ddd;
+            border-radius: 6px;
+            padding: 12px;
+            overflow-x: auto;
+            font-size: 12px;
+            line-height: 1.5;
+            max-height: 400px;
+            overflow-y: auto;
+        }
+        .copy-json-btn {
+            position: absolute;
+            top: 6px;
+            right: 6px;
+            font-size: 12px;
+            padding: 4px 10px;
+            background: #e8e8e8;
+            color: #333;
+            border: 1px solid #ccc;
+            border-radius: 4px;
+            margin: 0;
+        }
+        .copy-json-btn:hover { background: #ddd; }
+        .clean-packages {
+            color: #666;
+            font-size: 14px;
+            padding: 0 16px 12px;
+        }
+        @media (max-width: 600px) {
+            body { padding: 10px; }
+            h1 { font-size: 22px; }
+            textarea { min-height: 150px; font-size: 13px; }
+        }
+    </style>
+</head>
+<body>
+    <h1>Python Vulnerability Lookup</h1>
+    <p>Paste a <code>pyproject.toml</code> or <code>requirements.txt</code> to check packages for known vulnerabilities via <a href="https://osv.dev">OSV.dev</a>.</p>
+
+    <div style="margin-bottom: 12px;">
+        <label for="pathInput" style="font-weight: 600; display: block; margin-bottom: 4px;">Or load from a GitHub repo or URL:</label>
+        <div style="display: flex; gap: 8px;">
+            <input type="text" id="pathInput" placeholder="simonw/datasette or https://..." style="flex: 1; padding: 8px 12px; border: 2px solid #ddd; border-radius: 6px; font-size: 14px;" onkeydown="if(event.key==='Enter'){event.preventDefault();fetchFromPath()}">
+            <button id="fetchBtn" onclick="fetchFromPath()">Fetch</button>
+        </div>
+        <div style="font-size: 13px; color: #666; margin-top: 4px;">
+            Examples: <code>simonw/datasette</code>, <code>https://github.com/simonw/datasette</code>, or a direct URL to a requirements.txt/pyproject.toml
+        </div>
+    </div>
+
+    <textarea id="input" placeholder="Paste your pyproject.toml or requirements.txt here..."></textarea>
+    <br>
+    <button id="checkBtn" onclick="checkVulnerabilities()">Check Vulnerabilities</button>
+
+    <div id="status"></div>
+    <div id="results"></div>
+
+    <script>
+    function parseRequirementsTxt(text) {
+        const packages = [];
+        for (let line of text.split('\n')) {
+            line = line.replace(/#.*$/, '').trim();
+            if (!line || line.startsWith('-')) continue;
+            const m = line.match(/^([a-zA-Z0-9_.-]+)\s*(?:\[.*?\])?\s*(?:==\s*([^\s;,]+))?/);
+            if (m) {
+                packages.push({ name: m[1], version: m[2] || null });
+            }
+        }
+        return packages;
+    }
+
+    function extractArrayItems(text) {
+        // Extract strings from a TOML array that may span multiple lines
+        const items = [];
+        const re = /"([^"]+)"|'([^']+)'/g;
+        let m;
+        while ((m = re.exec(text)) !== null) {
+            items.push(m[1] || m[2]);
+        }
+        return items;
+    }
+
+    function parsePep508(dep) {
+        const m = dep.match(/^([a-zA-Z0-9_.-]+)\s*(?:\[.*?\])?\s*(?:==\s*([^\s;,]+))?/);
+        if (m) return { name: m[1], version: m[2] || null };
+        return null;
+    }
+
+    function findTomlArrays(text, startIdx) {
+        // From startIdx, find the [ and matching ], handling nested brackets
+        const open = text.indexOf('[', startIdx);
+        if (open === -1) return null;
+        let depth = 0;
+        for (let i = open; i < text.length; i++) {
+            if (text[i] === '[') depth++;
+            else if (text[i] === ']') {
+                depth--;
+                if (depth === 0) return text.slice(open, i + 1);
+            }
+        }
+        return null;
+    }
+
+    function parsePyprojectToml(text) {
+        const packages = [];
+        const seen = new Set();
+
+        function addDeps(depStrings) {
+            for (const s of depStrings) {
+                const parsed = parsePep508(s);
+                if (parsed) {
+                    const key = parsed.name.toLowerCase();
+                    if (!seen.has(key)) {
+                        seen.add(key);
+                        packages.push(parsed);
+                    }
+                }
+            }
+        }
+
+        // Find [project] dependencies
+        const depsMatch = text.match(/^dependencies\s*=\s*/m);
+        if (depsMatch) {
+            const arr = findTomlArrays(text, depsMatch.index + depsMatch[0].length - 1);
+            if (arr) addDeps(extractArrayItems(arr));
+        }
+
+        // Find all array assignments that look like dependency lists in optional-dependencies,
+        // dependency-groups, or similar sections
+        const arrayAssignRe = /^([a-zA-Z0-9_-]+)\s*=\s*\[/gm;
+        let match;
+        while ((match = arrayAssignRe.exec(text)) !== null) {
+            // Skip the main dependencies we already handled
+            if (match[1] === 'dependencies') continue;
+            // Check if this is inside a relevant section
+            const before = text.slice(0, match.index);
+            const lastSection = before.match(/\[([^\]]+)\]\s*$/m);
+            if (lastSection) {
+                const section = lastSection[1].toLowerCase();
+                if (section.includes('dependencies') || section.includes('dependency-groups')) {
+                    const arr = findTomlArrays(text, match.index + match[0].length - 1);
+                    if (arr) addDeps(extractArrayItems(arr));
+                }
+            }
+        }
+
+        // Also handle dependency-groups style: group = ["dep1", "dep2"]
+        // where section header is [dependency-groups]
+        return packages;
+    }
+
+    function detectAndParse(text) {
+        text = text.trim();
+        if (text.includes('[project]') || text.includes('[dependency-groups]') || text.includes('[tool.')) {
+            return parsePyprojectToml(text);
+        }
+        return parseRequirementsTxt(text);
+    }
+
+    function showStatus(msg, type) {
+        const el = document.getElementById('status');
+        el.textContent = msg;
+        el.className = 'visible ' + type;
+    }
+
+    function hideStatus() {
+        document.getElementById('status').className = '';
+    }
+
+    function severityClass(severity) {
+        if (!severity) return 'severity-unknown';
+        const s = severity.toLowerCase();
+        if (s === 'critical') return 'severity-critical';
+        if (s === 'high') return 'severity-high';
+        if (s === 'moderate') return 'severity-moderate';
+        if (s === 'low') return 'severity-low';
+        return 'severity-unknown';
+    }
+
+    function getSeverity(vuln) {
+        return vuln.database_specific?.severity || null;
+    }
+
+    function getAffectedRange(vuln) {
+        if (!vuln.affected) return '';
+        for (const a of vuln.affected) {
+            if (a.package?.ecosystem === 'PyPI' && a.ranges) {
+                for (const r of a.ranges) {
+                    const events = r.events || [];
+                    const introduced = events.find(e => e.introduced)?.introduced;
+                    const fixed = events.find(e => e.fixed)?.fixed;
+                    if (introduced && fixed) return `${introduced} \u2013 fixed in ${fixed}`;
+                    if (introduced) return `introduced in ${introduced}`;
+                }
+            }
+        }
+        return '';
+    }
+
+    const jsonStore = {};
+
+    function copyJson(btn) {
+        const key = btn.getAttribute('data-json-key');
+        const json = jsonStore[key];
+        navigator.clipboard.writeText(json).then(() => {
+            btn.textContent = 'Copied!';
+            setTimeout(() => { btn.textContent = 'Copy'; }, 2000);
+        });
+    }
+
+    async function checkVulnerabilities() {
+        const input = document.getElementById('input').value;
+        document.getElementById('results').innerHTML = '';
+
+        if (!input.trim()) {
+            showStatus('Please paste a pyproject.toml or requirements.txt above.', 'error');
+            return;
+        }
+
+        const packages = detectAndParse(input);
+        if (packages.length === 0) {
+            showStatus('No packages found. Check that you pasted a valid pyproject.toml or requirements.txt.', 'error');
+            return;
+        }
+
+        showStatus(`Found ${packages.length} package${packages.length > 1 ? 's' : ''}. Querying OSV.dev...`, 'info');
+        await runVulnCheck(packages);
+    }
+
+    function renderResults(packages, packageVulns, vulnDetails) {
+        const resultsDiv = document.getElementById('results');
+        resultsDiv.innerHTML = '';
+
+        const withVulns = packages.filter((_, i) => packageVulns[i].length > 0);
+        const clean = packages.filter((_, i) => packageVulns[i].length === 0);
+        const totalVulnCount = packageVulns.reduce((sum, ids) => sum + ids.length, 0);
+
+        // Summary
+        const summary = document.createElement('div');
+        summary.className = 'summary';
+        if (withVulns.length === 0) {
+            summary.textContent = `No known vulnerabilities found across ${packages.length} package${packages.length > 1 ? 's' : ''}.`;
+        } else {
+            summary.innerHTML = `Found <strong>${totalVulnCount} vulnerabilit${totalVulnCount === 1 ? 'y' : 'ies'}</strong> across <strong>${withVulns.length} package${withVulns.length > 1 ? 's' : ''}</strong>. ${clean.length} package${clean.length !== 1 ? 's' : ''} clean.`;
+        }
+        resultsDiv.appendChild(summary);
+
+        // Packages with vulnerabilities
+        for (let i = 0; i < packages.length; i++) {
+            const pkg = packages[i];
+            const ids = packageVulns[i];
+            if (ids.length === 0) continue;
+
+            const section = document.createElement('div');
+            section.className = 'package-section';
+
+            const header = document.createElement('div');
+            header.className = 'package-header has-vulns';
+            header.innerHTML = `${pkg.name}` +
+                (pkg.version ? ` <span class="version-tag">${pkg.version}</span>` : '') +
+                ` <span class="vuln-count">${ids.length} vulnerabilit${ids.length === 1 ? 'y' : 'ies'}</span>`;
+            section.appendChild(header);
+
+            for (const id of ids) {
+                const vuln = vulnDetails[id];
+                if (!vuln) continue;
+
+                const item = document.createElement('div');
+                item.className = 'vuln-item';
+
+                const severity = getSeverity(vuln);
+                const sevClass = severityClass(severity);
+                const range = getAffectedRange(vuln);
+                const aliases = (vuln.aliases || []).join(', ');
+
+                let html = `<div class="vuln-title">
+                    <span class="severity-badge ${sevClass}">${severity || 'Unknown'}</span>
+                    <span class="vuln-id"><a href="https://osv.dev/vulnerability/${encodeURIComponent(vuln.id)}" target="_blank" rel="noopener">${vuln.id}</a></span>
+                </div>`;
+                if (vuln.summary) {
+                    html += `<div class="vuln-summary">${escapeHtml(vuln.summary)}</div>`;
+                }
+                if (aliases) {
+                    html += `<div class="vuln-aliases">Aliases: ${escapeHtml(aliases)}</div>`;
+                }
+                if (range) {
+                    html += `<div class="vuln-affected">Affected: ${escapeHtml(range)}</div>`;
+                }
+
+                // Raw JSON details
+                const jsonStr = JSON.stringify(vuln, null, 2);
+                const jsonKey = `vuln-${vuln.id}`;
+                jsonStore[jsonKey] = jsonStr;
+                html += `<details class="raw-json">
+                    <summary>View raw JSON</summary>
+                    <div class="json-container">
+                        <button class="copy-json-btn" data-json-key="${escapeHtml(jsonKey)}" onclick="copyJson(this)">Copy</button>
+                        <pre>${escapeHtml(jsonStr)}</pre>
+                    </div>
+                </details>`;
+
+                item.innerHTML = html;
+                section.appendChild(item);
+            }
+
+            resultsDiv.appendChild(section);
+        }
+
+        // Clean packages
+        if (clean.length > 0) {
+            const cleanSection = document.createElement('div');
+            cleanSection.className = 'package-section';
+            const cleanHeader = document.createElement('div');
+            cleanHeader.className = 'package-header clean';
+            cleanHeader.textContent = `${clean.length} package${clean.length !== 1 ? 's' : ''} with no known vulnerabilities`;
+            cleanSection.appendChild(cleanHeader);
+
+            const list = document.createElement('div');
+            list.className = 'clean-packages';
+            list.textContent = clean.map(p => p.name + (p.version ? ` ${p.version}` : '')).join(', ');
+            cleanSection.appendChild(list);
+            resultsDiv.appendChild(cleanSection);
+        }
+    }
+
+    function escapeHtml(str) {
+        const div = document.createElement('div');
+        div.textContent = str;
+        return div.innerHTML;
+    }
+
+    function resolveGitHubRawUrls(path) {
+        // Direct URL to a file
+        if (path.startsWith('http://') || path.startsWith('https://')) {
+            // GitHub repo URL like https://github.com/owner/repo
+            const ghMatch = path.match(/^https?:\/\/github\.com\/([^/]+\/[^/]+)\/?$/);
+            if (ghMatch) {
+                const repo = ghMatch[1];
+                return {
+                    repo,
+                    urls: [
+                        `https://raw.githubusercontent.com/${repo}/refs/heads/main/pyproject.toml`,
+                        `https://raw.githubusercontent.com/${repo}/refs/heads/main/requirements.txt`,
+                        `https://raw.githubusercontent.com/${repo}/refs/heads/master/pyproject.toml`,
+                        `https://raw.githubusercontent.com/${repo}/refs/heads/master/requirements.txt`,
+                    ]
+                };
+            }
+            // Direct URL to a raw file
+            return { repo: null, urls: [path] };
+        }
+        // owner/repo shorthand
+        if (path.match(/^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/)) {
+            return {
+                repo: path,
+                urls: [
+                    `https://raw.githubusercontent.com/${path}/refs/heads/main/pyproject.toml`,
+                    `https://raw.githubusercontent.com/${path}/refs/heads/main/requirements.txt`,
+                    `https://raw.githubusercontent.com/${path}/refs/heads/master/pyproject.toml`,
+                    `https://raw.githubusercontent.com/${path}/refs/heads/master/requirements.txt`,
+                ]
+            };
+        }
+        return { repo: null, urls: [] };
+    }
+
+    async function fetchFromPath(path) {
+        if (!path) {
+            path = document.getElementById('pathInput').value.trim();
+        }
+        if (!path) {
+            showStatus('Please enter a GitHub repo or URL.', 'error');
+            return;
+        }
+
+        // Update URL bar and title
+        const url = new URL(window.location);
+        url.searchParams.set('path', path);
+        history.replaceState(null, '', url);
+        document.title = `Python Vulnerability Lookup: ${path}`;
+
+        document.getElementById('pathInput').value = path;
+
+        const fetchBtn = document.getElementById('fetchBtn');
+        const checkBtn = document.getElementById('checkBtn');
+        fetchBtn.disabled = true;
+        checkBtn.disabled = true;
+
+        const { repo, urls } = resolveGitHubRawUrls(path);
+        if (urls.length === 0) {
+            showStatus('Could not parse that path. Use owner/repo, a GitHub URL, or a direct file URL.', 'error');
+            fetchBtn.disabled = false;
+            checkBtn.disabled = false;
+            return;
+        }
+
+        showStatus(`Fetching dependency files${repo ? ` from ${repo}` : ''}...`, 'info');
+
+        try {
+            const results = await Promise.all(urls.map(async u => {
+                try {
+                    const resp = await fetch(u);
+                    if (resp.ok) return { url: u, text: await resp.text() };
+                } catch {}
+                return null;
+            }));
+
+            const found = results.filter(Boolean);
+            if (found.length === 0) {
+                showStatus('No pyproject.toml or requirements.txt found at that location.', 'error');
+                fetchBtn.disabled = false;
+                checkBtn.disabled = false;
+                return;
+            }
+
+            // Combine all found files, parse each and merge packages
+            const allPackages = [];
+            const seen = new Set();
+            const fileNames = [];
+
+            for (const { url, text } of found) {
+                const fileName = url.split('/').pop();
+                fileNames.push(fileName);
+                const pkgs = detectAndParse(text);
+                for (const p of pkgs) {
+                    const key = p.name.toLowerCase();
+                    if (!seen.has(key)) {
+                        seen.add(key);
+                        allPackages.push(p);
+                    }
+                }
+            }
+
+            if (allPackages.length === 0) {
+                showStatus(`Found ${fileNames.join(' and ')} but no packages could be extracted.`, 'error');
+                fetchBtn.disabled = false;
+                checkBtn.disabled = false;
+                return;
+            }
+
+            // Show combined content in textarea
+            document.getElementById('input').value = found.map(f => `# ${f.url.split('/').pop()}\n${f.text}`).join('\n\n');
+
+            showStatus(`Found ${allPackages.length} package${allPackages.length > 1 ? 's' : ''} from ${fileNames.join(' and ')}. Querying OSV.dev...`, 'info');
+
+            // Run the vulnerability check directly with these packages
+            await runVulnCheck(allPackages);
+
+        } catch (err) {
+            showStatus(`Error: ${err.message}`, 'error');
+        } finally {
+            fetchBtn.disabled = false;
+            checkBtn.disabled = false;
+        }
+    }
+
+    async function runVulnCheck(packages) {
+        const resultsDiv = document.getElementById('results');
+        resultsDiv.innerHTML = '';
+        const btn = document.getElementById('checkBtn');
+        btn.disabled = true;
+
+        try {
+            const queries = packages.map(p => {
+                const q = { package: { name: p.name, ecosystem: 'PyPI' } };
+                if (p.version) q.version = p.version;
+                return q;
+            });
+
+            const batchResp = await fetch('https://api.osv.dev/v1/querybatch', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ queries })
+            });
+
+            if (!batchResp.ok) throw new Error(`API returned ${batchResp.status}`);
+            const batchData = await batchResp.json();
+
+            const vulnIds = new Set();
+            const packageVulns = [];
+            for (let i = 0; i < packages.length; i++) {
+                const result = batchData.results[i];
+                const ids = (result.vulns || []).map(v => v.id);
+                packageVulns.push(ids);
+                ids.forEach(id => vulnIds.add(id));
+            }
+
+            const totalVulns = vulnIds.size;
+            if (totalVulns > 0) {
+                showStatus(`Found ${totalVulns} vulnerabilit${totalVulns === 1 ? 'y' : 'ies'}. Fetching details...`, 'info');
+            }
+
+            const vulnDetails = {};
+            if (totalVulns > 0) {
+                const fetches = [...vulnIds].map(async id => {
+                    const resp = await fetch(`https://api.osv.dev/v1/vulns/${encodeURIComponent(id)}`);
+                    if (resp.ok) vulnDetails[id] = await resp.json();
+                });
+                await Promise.all(fetches);
+            }
+
+            hideStatus();
+            renderResults(packages, packageVulns, vulnDetails);
+        } catch (err) {
+            showStatus(`Error: ${err.message}`, 'error');
+        } finally {
+            btn.disabled = false;
+        }
+    }
+
+    // Check URL params on load
+    const params = new URLSearchParams(window.location.search);
+    const pathParam = params.get('path');
+    if (pathParam) {
+        document.getElementById('pathInput').value = pathParam;
+        fetchFromPath(pathParam);
+    }
+    </script>
+</body>
+</html>
