DevGuard: Open-Source Vulnerability Management for the Software Supply Chain
Help Net Security, Wednesday, October 21st, 2026
DevGuard, an OWASP incubating project, centralizes scanning, SBOM/VEX handling and a dependency firewall in a free self-hosted platform.
DevGuard is a free, self-hostable OWASP Incubating Project that collects a project's security findings, ranks them by risk and tracks them.
Its CLI wraps open-source tools for secret scanning, static analysis, dependency checks, IaC, container and license scanning, or teams can upload CycloneDX SBOMs and SARIF results from Trivy, Grype or Semgrep.
Findings sync with GitHub, GitLab and Jira, and a dependency firewall proxies npm, Go and Python registries to block malicious packages.
It also manages reusable VEX rules, publishes live SBOM/VEX links and generates evidence for ISO 27001, the EU Cyber Resilience Act and SLSA.