On the recordRead 11 Oct 202613 facts
depproof
Plans and prices
Scanner
Free
Free for open source and organizations under $1M revenue · over $1M revenue, license adds priority support, upgrade guidance, and policy templates
Read 11 Oct 2026 · depproof.com
Hub
Priced on request
Org-wide dashboard and cross-repository blast radius · license posture and current SBOM · waivers with append-only audit trail · SSO/OIDC
Read 11 Oct 2026 · depproof.com
On the record
- Advisory data
- The scanner checks components against open OSV advisory data.depproof.com · read 11 Oct 2026
- CI options
- The scanner is available as a GitHub Action or a self-hosted container for CI pipelines.depproof.com · read 11 Oct 2026
- Coverage reporting
- Each scan reports how much of the dependency tree it resolved and can fail the build when coverage is insufficient.depproof.com · read 11 Oct 2026
- Data handling
- The privacy policy says the scanner does not send source code, dependency data, SBOMs, or scan findings to the company or third parties.depproof.com · read 11 Oct 2026
- Dependency coverage
- The scanner resolves transitive dependencies and checks components for known vulnerabilities and license obligations.depproof.com · read 11 Oct 2026
- Hub governance
- The Hub offers cross-repository blast-radius search, organization-wide license posture, current CycloneDX SBOMs, and waivers with owners, expiries, and an append-only audit trail.depproof.com · read 11 Oct 2026
- Integrations
- The getting-started page describes a GitHub Action and says the container can be used with GitLab CI, Jenkins, or locked-down pipelines.depproof.com · read 11 Oct 2026
- Intended users
- The maker describes the Hub as for regulated teams, growing repository estates, and teams that need data deployed within their own network.depproof.com · read 11 Oct 2026
- Notable limitation
- The product says it does not scan container or operating-system packages.depproof.com · read 11 Oct 2026
- Purpose
- depproof provides self-hosted software composition analysis for Java, JavaScript, Python, and Go dependencies.depproof.com · read 11 Oct 2026
- Scan output
- Each run can produce a self-contained HTML report, a CycloneDX SBOM, and a pass/fail policy gate.depproof.com · read 11 Oct 2026
- Support
- For Scanner licenses over $1M revenue, the pricing page lists priority support and upgrade guidance; the Hub includes SLA and onboarding support.depproof.com · read 11 Oct 2026
- Supported inputs
- The homepage lists pom.xml, gradle.lockfile, package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, and go.mod.depproof.com · read 11 Oct 2026
