OWASP DevGuard

Open-source vulnerability management for the full software supply chain

An OWASP Incubating Project · Made in Germany 🇩🇪 for the world 🌍

Documentation · Live Demo · Report Bug · Chat (Matrix)

[!NOTE] Join the monthly DevGuard Open Community Call — always at 17:00 (UTC+2). Help shape new features and discuss contributions. For support, join the community Matrix space.

What is DevGuard?

DevGuard is a single platform that finds, prioritizes, and tracks vulnerabilities across your entire software supply chain — from source code and third-party dependencies to container images, infrastructure-as-code, and deployed artifacts.

It replaces the patchwork of disconnected scanners, spreadsheets, and manual triage with one system that scans, prioritizes, tracks, and documents security findings across the whole SDLC. DevGuard is built exclusively on open standards — SBOM, VEX, SARIF, SLSA, in-toto — so there’s no vendor lock-in and no proprietary formats.

This repository contains the DevGuard Backend (Go API + PostgreSQL). The web frontend lives at l3montree-dev/devguard-web.

Why DevGuard?

Traditional security tools treat vulnerability management as something separate from development — generating 50–80% false-positive noise, living in spreadsheets, and demanding context switches from engineers who just want to ship. DevGuard flips that: security intelligence is delivered where developers already work (pull requests, CI, issue trackers), and real risks surface first thanks to multi-dimensional scoring.

Use DevGuard if you need to:

Know what’s in your software — automated SBOM generation and dependency tracking across all projects.
Find vulnerabilities continuously — SCA, SAST, secret scanning, IaC, container scanning, and license compliance, all from one CLI.
Cut through the noise — risk-based prioritization using CVSS + EPSS + component depth + your CIA assessment, not raw CVSS alone.
Triage at scale — VEX-based assessment workflows and reusable VEX rules to handle recurring false positives once, not per project.
Block malicious packages — Dependency Firewall for npm, Go, and Python that checks packages before they enter your codebase.
Meet compliance requirements — automated evidence for ISO 27001, Cyber Resilience Act (CRA), BSI IT-Grundschutz, and SLSA.
Share transparency data — live SBOM and VEX endpoints that stay current, because a dependency safe today can have a CVE tomorrow.

DevGuard is for developers, DevOps engineers, and security teams. No specialized security knowledge required.

Key Capabilities

Capability	What it does
Full DevSecOps pipeline	Secret scanning, SAST, SCA, IaC scanning, container scanning, and license compliance — one CLI, one CI integration
Risk-based prioritization	Scores every finding as `(CVSS-BE × (EPSS + 1)) / 2 / Component Depth` so you fix what actually matters first
SBOM & VEX management	CycloneDX SBOMs, full VEX workflows, and live SBOM/VEX endpoints that always reflect current state
Dependency Firewall	Proxies npm, Go, and Python registries — blocks known-malicious and vulnerable packages before download
Supply-chain integrity	in-toto attestations, SLSA provenance, cosign signatures, reproducible builds with Nix
Policy enforcement	Organization-wide security policies written in OPA/Rego, enforced automatically
Bring your own scanner	Ingests SBOM (CycloneDX) and SARIF from Trivy, Grype, Semgrep, and any standards-compliant tool
Issue tracker integration	GitHub Issues, GitLab Issues, and Jira — bidirectional sync with slash-command triage