Do not require a public URL — analyze everything from the source code

package managers (package.json