Developer Security Platform
Manage all Aspects of AppSec
DevGuard sits at the center of your application security workflow - connecting scanners, assessments, policies, and remediation into a single unified platform.
Continuous Monitoring
Track deployed software for newly disclosed vulnerabilities in real time.
Instant Alerting
Automatically create issues when new CVEs affect your software.
False Positive Reduction
Eliminate noise with VEX-based assessment sharing.
Risk Prioritization
Focus on what matters with improved scoring and exploit probability analysis.
Actionable Remediation
Get clear, developer-friendly fix guidance directly in your workflow.
Integrations
Connect with your GitLab or GitHub repos, CI pipelines, and issue trackers.
Open Standards (SBOM, VEX & SARIF)
Ingest inputs from any scanner or tool that supports open standards.
Open Source Licensed
DevGuard is proudly open source, with a strong commitment to transparency.
Application Security Platform
Security across the whole Supply Chain
DevGuard provides end-to-end vulnerability management - from continuous scanning and intelligent alerting to VEX-powered false positive reduction and organization-wide security governance.
One CLI. Every AppSec Workflow.
Scan, test, and attest - without leaving your terminal
devguard-scanner plugs straight into your existing workflow: run software composition analysis, static application security testing, and sign attestations, all from a single command-line tool.
Dependency Proxy
Block threats before they reach your code.
DevGuard's dependency firewall sits between your builds and the public registries, so a package known to be malicious is refused on the way in rather than reported after the fact.
A control point in front of every install
Every npm, Go, PyPI, Maven, Composer and container image request is checked against the malicious package database first. Rules are plain text in gitignore syntax, scoped to an organisation, a project or a single repository.
malicious-package advisories every request is checked against, as of September 2026.
- npm, Go, PyPI, Maven, Composer and OCI images through one gateway
- Blocked installs return HTTP 403, naming the advisory
- Helps blocking attacks like the 2025 Shai-Hulud npm worm
VEX & Assessment Sharing
Software Security as Community Effort
Multi-level VEX handling, automated reachability analysis, and crowdsourced assessments - DevGuard eliminates false positives so you can focus on real risks.
Multi-Level VEX Handling
Share assessments to your consumers and receive from your suppliers. DevGuard supports full VEX lifecycle management - from initial triage to final justification.
Crowdsourced VEX-Rules
Started mid 2026: Users share anonymized assessment results as reusable VEX-Rules. Benefit from the collective knowledge of the community to reduce handling effort even further.
Automated Vexing for npm
Coming 2026: Reachability analysis for the npm ecosystem that handles up to 70% of findings automatically. DevGuard determines whether vulnerable code paths are actually reachable.
projects on openCode used DevGuard as of August 2026.
Public Sector
In production across German public administration
DevGuard secures the software supply chain of openCode, the open-source platform of German public administration - with vulnerability management, software bills of materials and evidence that holds up in an audit.
- A software bill of materials for every build
- Evidence for Cyber Resilience Act and BSI reporting obligations
- Self-hosted and open source - no vendor lock-in
Testimonials
Trusted by Security-Focused Teams.
“DevGuard schafft es durch moderne Software-Security-Konzepte unseren Entwicklern und Nutzern auf openCode einen benutzerfreundlichen Einstieg in die Best Practices des Schwachstellenmanagements zu ermöglichen, ohne dabei Abstriche in der Enterprisefähigkeit zu machen.”
Julian Schauder
DevSecOps & Development Lead @ ZenDiS GmbH
Pricing
Secure Software Development &
Pricing made easy
Protect your code with confidence - DevGuard simplifies secure software development while offering flexible pricing tailored to your needs.
Start your 14-day free trialOpen Source
Fully-fledged self-hosting solution with community support. Free of charge for every FLOSS project. Get SaaS free as non-commercial FLOSS project.
What's included
SaaS
The carefree package, ideal for organizations that want to get started quickly with a high-performance service.
What's included
Enterprise
Self-hosting with an enterprise contract: contractual response times, vetted updates from the publisher and a fixed contract partner.
What's included
Screenshots
Everybody loves a good screenshot...
Open Source
Committed to open source, in code and beyond.
DevGuard is developed in the open under AGPL-3.0 and built entirely on open standards. It stands on the shoulders of countless open-source projects, and we are deeply grateful to the maintainers who keep them going.
Proud member of
Thank you to our contributors
DevGuard is shaped by everyone who contributes - through code, ideas, issue reports or simply by being part of our community. We see you and we appreciate you.
Meet the contributorsFAQ
Frequently Asked Questions
The most pressing questions we get from developers, security & compliance leaders, and decision-makers evaluating DevGuard.
For Developers
For CISOs & Compliance Officers
For Executives & Decision-Makers
Start securing your applications in minutes, not months.
DevGuard allows you to start securing your applications in minutes. No complex setup, no code changes, just instant visibility and protection.