DevGuard: Open-Source Platform Centralizes Software Supply Chain Vulnerability Management
DevGuard, an OWASP Incubating Project, offers a unified open-source platform to consolidate, prioritize, and manage security findings across the software supply chain.
A new open-source platform named DevGuard aims to streamline vulnerability management for the software supply chain by consolidating security findings from various tools into a single, manageable interface. Developed as an OWASP Incubating Project, DevGuard is designed to be self-hosted and provides developers with a centralized view of potential risks, ranked by severity.
DevGuard integrates multiple security scanning capabilities through a single command-line interface (CLI). These include secret scanning, static code analysis, dependency vulnerability checks against known CVEs, infrastructure-as-code (IaC) scanning, container scanning, and license compliance checks. The platform is built to wrap around existing open-source security tools, allowing teams to leverage their current investments.
For organizations already utilizing tools like Trivy, Grype, or Semgrep, DevGuard offers flexibility. Users can bypass its built-in scanners and instead provide their security findings by uploading CycloneDX Software Bill of Materials (SBOMs) or SARIF results. This interoperability ensures that DevGuard can fit into diverse development workflows without forcing a complete toolchain overhaul.
To facilitate efficient remediation, DevGuard synchronizes security findings bidirectionally with popular issue tracking systems such as GitHub Issues, GitLab Issues, and Jira. Developers can then triage and manage these vulnerabilities directly within their familiar project management environments, using simple slash commands for actions.
A key feature of DevGuard is its Dependency Firewall. This component acts as a proxy for package registries like npm, Go, and Python, actively blocking known malicious or vulnerable packages before they can be downloaded into a project. This proactive measure helps prevent the introduction of compromised dependencies early in the development lifecycle.
DevGuard also incorporates support for the Vulnerability Exploitability eXchange (VEX) format. VEX statements clarify whether a product is actually affected by a given CVE, helping to reduce noise from false positives. The platform allows for the creation of reusable VEX rules, enabling teams to dismiss recurring false positives across multiple projects efficiently.
To enhance transparency and compliance, DevGuard publishes SBOM and VEX data through live, updatable links. This feature is particularly useful for generating evidence required for various compliance frameworks, including ISO 27001, the EU Cyber Resilience Act, BSI IT-Grundschutz, and SLSA (Supply chain Levels for Software Artifacts).
DevGuard is publicly available on GitHub, offering its comprehensive suite of software supply chain security features free of charge to the open-source community and commercial entities alike. Its focus on integration, proactive blocking, and centralized management addresses critical needs in modern software development security.