- Home
- Vulnerability Management Software
- OWASP DevGuard
OWASP DevGuard
Bonn, Germany
What it is
OWASP DevGuard manages vulnerabilities across source code, dependencies, container images, infrastructure-as-code, and deployed artifacts. Its security pipeline covers secret scanning, SAST, SCA, IaC and container scanning, and license compliance. Findings are scored with CVSS-BE, EPSS, and component depth to help prioritize risk. DevGuard supports CycloneDX SBOMs, VEX workflows, and live SBOM and VEX endpoints; it can also ingest CycloneDX SBOM and SARIF data from tools including Trivy, Grype, and Semgrep. Issue synchronization with GitHub Issues, GitLab Issues, and Jira is bidirectional. Its dependency proxy supports npm, Go, and PyPI, blocking packages flagged in the OSSF malicious packages database. The platform can be self-hosted with Kubernetes or Docker Compose and includes a backend API and web UI; the standalone scanner supports Linux, macOS, and Windows. The source code uses AGPL-3.0-or-later. The Open Source plan is free for public projects with an OSI-approved license. SaaS starts at €449.10 a month on a one-year contract, paid yearly, and includes 10 user seats.
For and against
For
- Covers source code, dependencies, containers, and IaC
- Prioritizes findings with CVSS-BE, EPSS, and component depth
- Supports CycloneDX SBOMs and VEX workflows
- Self-hostable with Kubernetes or Docker Compose
- Standalone scanner supports Linux, macOS, and Windows
Against
- Free plan is limited to eligible public projects
- SaaS starts at €449.10 a month
- SaaS requires a one-year contract, paid yearly
The verdict
DevGuard combines vulnerability scanning, risk prioritization, SBOM and VEX support, and issue synchronization. Its free option is for qualifying public projects, while SaaS starts with a yearly commitment.
Who it suits
DevGuard identifies developers, DevOps engineers, and security teams as its intended users, and says specialized security knowledge is not required. Its self-hosting options and scanning coverage may suit teams managing vulnerabilities across code, dependencies, infrastructure, and deployed artifacts.
Plans and prices
Open Source
Free for public projects with OSI-approved license · all features · community support · self-hosted
Read 7 Oct 2026 · devguard.org
SaaS
Starting at · 10 user seats included · fully managed hosting in Germany · initial 1-hour setup workshop
Read 7 Oct 2026 · devguard.org
Enterprise
Self-hosted · 20 to 160 support hours per year · contractual response times of 16 h, 8 h or 4 h
Read 7 Oct 2026 · devguard.org
On the record
- Dependency firewall
- The dependency proxy supports npm, Go and PyPI and blocks packages flagged in the OSSF malicious packages database.docs.devguard.org · read 7 Oct 2026
- Deployment
- The platform is self-hostable using Kubernetes or Docker Compose and provides a backend API and web UI.docs.devguard.org · read 7 Oct 2026
- Integrations
- It lists GitHub Issues, GitLab Issues and Jira for bidirectional issue synchronization, including slash-command triage.owasp.github.io · read 7 Oct 2026
- Intended users
- DevGuard identifies developers, DevOps engineers and security teams as its intended users, and says specialized security knowledge is not required.owasp.github.io · read 7 Oct 2026
- License
- DevGuard's source code is distributed under the AGPL-3.0-or-later license.docs.devguard.org · read 7 Oct 2026
- Maker
- The DevGuard site identifies L3montree GmbH and the DevGuard Contributors in its copyright notice.devguard.org · read 7 Oct 2026
- Purpose
- DevGuard manages vulnerabilities across source code, dependencies, container images, infrastructure-as-code and deployed artifacts.owasp.github.io · read 7 Oct 2026
- Risk prioritization
- DevGuard scores findings using CVSS-BE, EPSS and component depth to prioritize risks.owasp.github.io · read 7 Oct 2026
- SBOM and VEX
- It supports CycloneDX SBOMs, VEX workflows and live SBOM and VEX endpoints.owasp.github.io · read 7 Oct 2026
- Scanner imports
- DevGuard can ingest CycloneDX SBOM and SARIF data from Trivy, Grype, Semgrep and other standards-compliant tools.owasp.github.io · read 7 Oct 2026
- Scanner platforms
- The standalone scanner supports Linux, macOS and Windows.docs.devguard.org · read 7 Oct 2026
- Scanning
- Its security pipeline covers secret scanning, SAST, SCA, IaC scanning, container scanning and license compliance.owasp.github.io · read 7 Oct 2026
- Security and compliance
- The project describes in-toto attestations, SLSA provenance, cosign signatures and automated evidence for ISO 27001, CRA, BSI IT-Grundschutz and SLSA.owasp.github.io · read 7 Oct 2026
- Support
- The project directs community users to its Matrix space and monthly community call.owasp.github.io · read 7 Oct 2026
