DevGuard is a free, open-source vulnerability management platform that aggregates a software project's security findings, ranks them by risk, and tracks them over time. It is an OWASP Incubating Project and can be self-hosted by any organization. The platform is designed to give teams a single view of supply chain risks without forcing them to abandon tools they already use.
Through one command-line interface, DevGuard wraps existing open-source scanners for secrets, static code analysis, dependency CVEs, infrastructure-as-code, containers, and licenses. Teams that already rely on Trivy, Grype, or Semgrep can skip the built-in scanners and instead upload CycloneDX SBOMs or SARIF results. Findings sync bidirectionally with GitHub Issues, GitLab Issues, and Jira, where developers can triage them using slash commands.
A notable feature is the Dependency Firewall, which proxies npm, Go, and Python registries and blocks known-malicious or vulnerable packages before they reach a build. DevGuard also supports Vulnerability Exploitability eXchange (VEX), letting teams write reusable rules to dismiss recurring false positives across projects. It publishes SBOM and VEX data at live links that update as new CVEs appear, and it generates evidence for standards such as ISO 27001, the EU Cyber Resilience Act, BSI IT-Grundschutz, and SLSA. DevGuard is available for free on GitHub.