DevGuard open-source platform ranks and tracks supply-chain findings
Original title: DevGuard: Open-source vulnerability management for the software supply chain
One CLI wraps six scan types, and a registry proxy can block known-malicious npm, Go, and Python packages before download.
DevGuard is a free, self-hosted open-source vulnerability management platform and an OWASP Incubating Project. One command line runs secret scanning, static analysis, dependency CVE checks, infrastructure-as-code checks, container scanning, and license checks, or teams can upload CycloneDX SBOMs and SARIF results. Findings sync with GitHub Issues, GitLab Issues, and Jira. A Dependency Firewall proxies npm, Go, and Python registries, and the project also handles reusable VEX rules and compliance evidence.
- Teams using Trivy, Grype, or Semgrep can skip the built-in scanners.
- Developers triage synced findings with slash commands.
- Reusable VEX rules can dismiss a recurring false positive once across projects.
- It generates evidence for ISO 27001, the EU Cyber Resilience Act, BSI IT-Grundschutz, and SLSA.
From the original article
1 min read at helpnetsecurity.com
DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. It’s an OWASP Incubating Project, and anyone can self-host it.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.