depproof icon
depproof icon

depproof

Self-hosted dependency security scanner that finds vulnerable third-party dependencies across your full tree, ranks them by active exploitation, and generates a CycloneDX SBOM.

depproof screenshot 1

Cost / License

  • Freemium (Usage-based)
  • Proprietary

Platforms

  • Self-Hosted
  • Linux
  • Docker
depproof screenshot 1
depproof screenshot 2
+1
depproof screenshot 3
depproof alternatives  
0likes
17alternatives
0articles
Save

Features

Properties

  1.  Lightweight
  2.  Privacy focused

Features

  1.  File Versioning
  2.  Dark Mode
  3.  Ad-free
  4.  Two-factor Authentication
  5. Git icon  Git Support
  6.  CI/CD
  7.  OSS License Compliance

 Tags

depproof News & Activities

Highlights All activities

Recent activities

depproof information

  • Developed by

    depproof

  • Licensing

    Proprietary and Freemium product.

  • Pricing

    Usage-based pricing (pay per credit or per use) + free version with limited functionality.

  • Alternatives

    17 alternatives listed

  • Badge

    Get an embeddable badge for depproof

  • Supported Languages

    • English
depproof was added to AlternativeTo by Prasad Vara on and this page was last updated .

No comments or reviews, maybe you want to be first?

Official Links

What is depproof?

depproof is a self-hosted dependency security scanner, distributed as a single container image and as a GitHub Action. It resolves the complete transitive tree of third-party dependencies in a project, matches every package against OSV advisory data, and ranks the findings so teams know what to fix first.

Ranking uses signals such as active exploitation (the CISA Known Exploited Vulnerabilities catalog) and, for Maven, npm and .NET, whether a package ever loaded while your own CI tests ran. Nothing is removed; the list is simply put in order. It also classifies every license as allowed, review or forbidden, and writes a CycloneDX SBOM you can hand to a customer or an auditor.

It runs as one container, as a GitHub Action, or as a GitLab CI job, on your own infrastructure. Your source and your findings never leave it, so it also works air-gapped. The output is a self-contained HTML report, a CycloneDX SBOM, and a pass/fail CI gate on a severity you choose.

Supported ecosystems are Java (Maven and Gradle), JavaScript and Node (npm, pnpm, yarn, bun), Python (PyPI), Go (modules) and .NET (NuGet).

Priced per depproof product (the Scanner, and the Hub added to it), never per seat, per committer or per application. The Scanner is free for open-source projects and for organizations under $1M annual revenue.