devguard

Open-source vulnerability management for the full software supply chain

An OWASP Incubating Project · Made in Germany 🇩🇪 for Europe 🇪🇺

Documentation · Live Demo · Report Bug · Chat (Matrix)

[!NOTE] Join the monthly DevGuard Open Community Call — always at 17:00 (UTC+2). Help shape new features and discuss contributions. For support, join the community Matrix space.

What is DevGuard?

DevGuard is a single platform that finds, prioritizes, and tracks vulnerabilities across your entire software supply chain — from source code and third-party dependencies to container images, infrastructure-as-code, and deployed artifacts.

It replaces the patchwork of disconnected scanners, spreadsheets, and manual triage with one system that scans, prioritizes, tracks, and documents security findings across the whole SDLC. DevGuard is built exclusively on open standards — SBOM, VEX, SARIF, SLSA, in-toto — so there's no vendor lock-in and no proprietary formats.

This repository contains the DevGuard Backend (Go API + PostgreSQL). The web frontend lives at l3montree-dev/devguard-web.

Why DevGuard?

Traditional security tools treat vulnerability management as something separate from development — generating 50–80% false-positive noise, living in spreadsheets, and demanding context switches from engineers who just want to ship. DevGuard flips that: security intelligence is delivered where developers already work (pull requests, CI, issue trackers), and real risks surface first thanks to multi-dimensional scoring.

Use DevGuard if you need to:

• Know what's in your software — automated SBOM generation and dependency tracking across all projects.
• Find vulnerabilities continuously — SCA, SAST, secret scanning, IaC, container scanning, and license compliance, all from one CLI.
• Cut through the noise — risk-based prioritization using CVSS + EPSS + component depth + your CIA assessment, not raw CVSS alone.
• Triage at scale — VEX-based assessment workflows and reusable VEX rules to handle recurring false positives once, not per project.
• Block malicious packages — Dependency Firewall for npm, Go, and Python that checks packages before they enter your codebase.
• Meet compliance requirements — automated evidence for ISO 27001, Cyber Resilience Act (CRA), BSI IT-Grundschutz, and SLSA.
• Share transparency data — live SBOM and VEX endpoints that stay current, because a dependency safe today can have a CVE tomorrow.

DevGuard is for developers, DevOps engineers, and security teams. No specialized security knowledge required.

Key Capabilities

Getting started

The full documentation lives at docs.devguard.org. It covers installation, quickstart, CI/CD integration, scanner usage, and configuration.

For details on connecting to your CI, setting up the dependency firewall, or self-hosting in production, see the documentation.

Documentation

The full documentation lives at docs.devguard.org. Start here:

• 🚀 Quickstart — spin up DevGuard and run your first scan
• 🧠 Key Concepts in 2 minutes — organizations, groups, assets, artifacts
• 📊 Risk Calculation — how findings are scored and prioritized
• 🛡️ Dependency Firewall — block malicious packages before they reach your code
• ✅ CRA Compliance — what DevGuard covers under the EU Cyber Resilience Act

Live Demo

We scan DevGuard with DevGuard. Browse the public instance to see real vulnerability data, SBOMs, and VEX assessments on a live project:

main.devguard.org/l3montree-cybersecurity/projects/devguard

Live (always-current) SBOM and VEX endpoints for this project:

Talks & Presentations

• FOSDEM 2026 — Securing Software for the Public Sector — Recording
• FrOSCon 2025 — Develop Secure Software — The DevGuard Project — Recording

Community & Contributing

• 💬 Chat: Matrix space
• 💡 Discussions: GitHub Discussions
• 🐛 Bugs / feature requests: GitHub Issues
• 📅 Monthly community call: see the note at the top of this README
• 👷 Contribute: read the contribution guide and pick up a help wanted issue

Please follow the Code of Conduct when participating.

License

DevGuard is licensed under AGPL-3.0-or-later. See LICENSE.txt.

Sponsors & Supporters