DevGuard

DevGuard is an open-source security platform for strengthening the software supply chain. It monitors deployed software for newly disclosed vulnerabilities and can create issues when new CVEs affect software. Risk scoring and exploit-probability analysis help prioritize findings, while VEX assessment sharing supports review of potential false positives. The platform connects with GitHub and GitLab repositories, CI pipelines, and issue trackers, and can ingest SBOM, VEX, and SARIF data from compatible tools. Its scanner CLI supports software composition analysis, static application security testing, and signing attestations. A dependency firewall checks npm, Go, PyPI, and container image requests against a malicious-package database and blocks known-bad releases. DevGuard also supports SBOM management, artifact signing, provenance attestations, and release policy gates. Its source code is under AGPL-3.0-or-later. The free self-hosted Open Source plan is for public projects with an OSI-approved license; non-commercial FLOSS projects can get SaaS free. Business SaaS costs €449.10 per month on a one-year contract paid yearly and includes 10 users and managed hosting in Germany.

DevGuard combines vulnerability monitoring with dependency checks and supply-chain artifact controls. Its free plan has a project-license restriction, while Business SaaS has an annual commitment.

It is aimed at developers, DevOps engineers, and security-conscious teams managing software supply-chain risks. The free self-hosted plan is limited to public projects with an OSI-approved license.

DevGuard is a software supply-chain security platform for development and security teams that want to connect vulnerability response with controls across dependencies and releases. It is strongest for teams with established CI and security workflows; its free tier is tightly scoped, and Business SaaS requires an annual contract.

Overview

DevGuard connects with GitLab and GitHub repositories, CI pipelines and issue trackers, and accepts SBOM, VEX and SARIF inputs from compatible tools. That makes it a useful coordination layer for teams that already produce security findings, rather than a reason to replace every scanner in the workflow. The project is open source under AGPL-3.0-or-later.

Its central appeal is linking detection to follow-through: monitoring deployed software for newly disclosed vulnerabilities, prioritizing risk and creating issues when CVEs affect software. This is a broad remit, but the public-project condition on its free self-hosted plan makes it a poor default for private commercial projects.

Key features

Vulnerability prioritization and response

Risk scoring and exploit-probability analysis help teams distinguish urgent exposure from lower-priority findings. VEX assessment sharing can reduce false positives by clarifying whether a vulnerability applies. Automatic issue creation can carry affected CVEs into a team's existing tracking process, which is valuable when security findings otherwise risk remaining detached from remediation work.

Dependency and release controls

The devguard-scanner CLI supports software composition analysis, static application security testing and signing attestations. DevGuard also supports SBOM management, build provenance, artifact signing, provenance attestations and release policy gates. Its dependency firewall checks npm, Go, PyPI and container image requests against a malicious-package database and blocks known-bad releases. That combination suits teams seeking checks across both dependencies and release artifacts; teams that only need a repository or package-hosting tool may find the scope broader than necessary.

Pricing

The Open Source plan costs nothing, billed Lifetime. It is self-hosted, includes all features and community support, but is for public projects with an OSI-approved license. Non-commercial FLOSS projects can get SaaS free. This is a strong route for qualifying open-source work, not a general free tier for private commercial development.

Business SaaS costs €449.10 a month on a 1 year contract, paid yearly. It includes 10 users, 4 hours of monthly support, managed hosting in Germany, a 1-hour setup workshop and 8×5 email support. The managed deployment and included support make it the practical option for teams that want to avoid self-hosting, but the yearly payment commitment and 10-user allowance should factor into budgeting. A 14-day trial offers a limited window to evaluate the paid service.

Enterprise has custom pricing and includes unlimited users, projects and assets, a custom SLA, phone and chat support, and on-premises or cloud deployment. It is the option for organizations that need deployment choice or expanded support rather than the defined Business package.

Platforms

DevGuard supports API, Linux, macOS, self-hosted, web and Windows environments. The self-hosted Open Source plan gives teams deployment control, while Business SaaS is fully managed in Germany.

Who it's for

Developers, DevOps engineers and security-conscious teams are the natural audience, especially where existing repositories, CI pipelines and issue trackers are part of the security process. Its documented support for requirements tied to ISO/IEC 27001 and PCI-DSS may also matter to teams working toward those standards. Private commercial teams should consider Business SaaS or Enterprise rather than assume the free Open Source terms fit.

Pros and cons

• Pros: Combines vulnerability monitoring, risk prioritization, dependency checks and artifact controls, so teams can address more of the supply chain in one workflow.
• Pros: Accepts SBOM, VEX and SARIF inputs and connects to repositories, CI and issue trackers, supporting integration with existing security processes.
• Cons: The free self-hosted plan is limited to public projects with an OSI-approved license; private commercial projects cannot treat it as a broadly available free tier.
• Cons: Business SaaS requires a one-year contract paid yearly, includes 10 users and provides 4 monthly support hours, which may not fit teams seeking a flexible monthly commitment.

Alternatives

Choose ReversingLabs Cloud Sandbox if you want a freemium option with a feature-preview upload allowance of 5 samples per day and support across Android, API, Linux, macOS, web and Windows.

ActiveState Platform is a fit to consider if a free organization for public projects is the priority; its paid organization is contact-sales priced.

Consider Sonatype Nexus Repository if you want a free Community Edition with full ecosystem support, CI/CD integration and an external PostgreSQL option.

Wisec may suit smaller projects that can work within its free allowance of 3 projects, 1,000 builds per month, 30 days of history and 1 PDF certificate per month.

Choose Chainloop if a self-hosted, free and open-source Community Edition is the priority and its lack of UI and curated policy library is acceptable.

CRACI is another option for readers comparing build-minute-based pricing, with metering per second and no monthly fee in its Pro plan.

Consider GUAC if you prefer an MIT-licensed open-source project and are prepared for setup requiring Docker, Docker Compose and jq.

Kusari is an alternative for readers interested in a product whose maker co-created GUAC and remains an active maintainer supporting its adoption.

Browse more options in Software Supply Chain Security Software.

Verdict

DevGuard is a compelling choice for development and security teams that want vulnerability response, dependency screening and release controls connected to their existing workflows. Its breadth is the main reason to choose it; the public-project restriction on free self-hosting and Business SaaS's annual commitment are the main reasons private or budget-conscious teams may look elsewhere.