Developer Security Platform
Manage all Aspects of AppSec
DevGuard sits at the center of your application security workflow - connecting scanners, assessments, policies, and remediation into a single unified platform.
Continuous Monitoring
Track deployed software for newly disclosed vulnerabilities in real time.
Instant Alerting
Automatically create issues when new CVEs affect your software.
False Positive Reduction
Eliminate noise with VEX-based assessment sharing.
Risk Prioritization
Focus on what matters with improved scoring and exploit probability analysis.
Actionable Remediation
Get clear, developer-friendly fix guidance directly in your workflow.
Integrations
Connect with your GitLab or GitHub repos, CI pipelines, and issue trackers.
Open Standards (SBOM, VEX & SARIF)
Ingest inputs from any scanner or tool that supports open standards.
Open Source Licensed
DevGuard is proudly open source, with a strong commitment to transparency.
Application Security Platform
Security across the whole Supply Chain
DevGuard provides end-to-end vulnerability management - from continuous scanning and intelligent alerting to VEX-powered false positive reduction and organization-wide security governance.
One CLI. Every AppSec Workflow.
Scan, test, and attest - without leaving your terminal
devguard-scanner plugs straight into your existing workflow: run software composition analysis, static application security testing, and sign attestations, all from a single command-line tool.
Dependency Proxy
Block threats before they reach your code.
DevGuard's dependency firewall sits between your builds and the public registries, so a package known to be malicious is refused on the way in rather than reported after the fact.
A control point in front of every install
Every npm, Go, PyPI and container image request is checked against the malicious package database first. Rules are plain text in gitignore syntax, scoped to an organisation, a project or a single repository.
malicious-package advisories every request is checked against, as of September 2026.
- npm, Go, PyPI and OCI container images through one gateway
- Blocked installs return HTTP 403, naming the advisory
- Helps blocking attacks like the 2025 Shai-Hulud npm worm
VEX & Assessment Sharing
Software Security as Community Effort
Multi-level VEX handling, automated reachability analysis, and crowdsourced assessments - DevGuard eliminates false positives so you can focus on real risks.
Multi-Level VEX Handling
Share assessments to your consumers and receive from your suppliers. DevGuard supports full VEX lifecycle management - from initial triage to final justification.
Crowdsourced VEX-Rules
Started mid 2026: Users share anonymized assessment results as reusable VEX-Rules. Benefit from the collective knowledge of the community to reduce handling effort even further.
Automated Vexing for npm
Coming 2026: Reachability analysis for the npm ecosystem that handles up to 70% of findings automatically. DevGuard determines whether vulnerable code paths are actually reachable.
projects on openCode used DevGuard as of August 2026.
Public Sector
In production across German public administration
DevGuard secures the software supply chain of openCode, the open-source platform of German public administration - with vulnerability management, software bills of materials and evidence that holds up in an audit.
- A software bill of materials for every build
- Evidence for Cyber Resilience Act and BSI reporting obligations
- Self-hosted and open source - no vendor lock-in
Testimonials
Trusted by Security-Focused Teams.
“DevGuard schafft es durch moderne Software-Security-Konzepte unseren Entwicklern und Nutzern auf openCode einen benutzerfreundlichen Einstieg in die Best Practices des Schwachstellenmanagements zu ermöglichen, ohne dabei Abstriche in der Enterprisefähigkeit zu machen.”
Julian Schauder
DevSecOps & Development Lead @ ZenDiS GmbH
Pricing
Secure Software Development &
Pricing made easy
Protect your code with confidence - DevGuard simplifies secure software development while offering flexible pricing tailored to your needs.
Start your 14-day free trialOpen Source
Fully-fledged self-hosting solution with community support. Free of charge for every FLOSS project. Get SaaS free as non-commercial FLOSS project.
What's included
Business SaaS
The carefree package, ideal for organizations that want to get started quickly with a high-performance service.
What's included
Enterprise
With SLA and support options for operation in your infrastructure. Ideal for large organizations or the security domain.
What's included
Screenshots
Everybody loves a good screenshot...
Start securing your applications in minutes, not months.
DevGuard allows you to start securing your applications in minutes. No complex setup, no code changes, just instant visibility and protection.
FAQ
Frequently Asked Questions
The most pressing questions we get from developers, security & compliance leaders, and decision-makers evaluating DevGuard.
For Developers
For CISOs & Compliance Officers
For Executives & Decision-Makers
Thanks to everyone who contributed to DevGuard, whether through code, ideas, issue reports, or simply by being part of our community. We see you and we appreciate you!
Made with ♥ in Germany 🇩🇪 for Europe 🇪🇺