DevGuard Unifies Six Supply Chain Scans Into One OWASP Platform

DevGuard operates as a free, open-source vulnerability management platform that consolidates security findings for software projects into a single interface, according to Help Net Security. As an OWASP Incubating Project, it allows organizations to self-host the solution. The system ranks identified risks and tracks remediation progress, targeting environments that require unified visibility into software supply chain security without relying on proprietary commercial suites.

What security checks does the platform perform?

DevGuard executes six distinct security scans through one command-line interface that wraps existing open-source tools. These checks include secret scanning, static code analysis, dependency verification against known CVEs, infrastructure-as-code reviews, container scanning, and license compliance checks. Teams already utilizing tools like Trivy, Grype, or Semgrep can bypass the built-in scanners and instead upload CycloneDX SBOMs or SARIF results directly into the platform for centralized analysis.

How does the tool handle package dependencies?

The platform includes a Dependency Firewall that proxies npm, Go, and Python registries to block known-malicious or vulnerable packages before they are downloaded. It also manages Vulnerability Exploitability eXchange (VEX) statements, which clarify whether a product is actually affected by a specific CVE. Reusable VEX rules allow teams to dismiss recurring false positives once across multiple projects, reducing noise in vulnerability reporting.

How do developers interact with findings?

Security findings sync bidirectionally with GitHub Issues, GitLab Issues, and Jira, enabling developers to triage vulnerabilities within their existing workflows. Developers can use slash commands to manage issues directly from these platforms. DevGuard publishes SBOM and VEX data at live links that update automatically when new CVEs appear, ensuring that risk assessments remain current without manual intervention.

What compliance evidence does it generate?

DevGuard generates evidence for several regulatory frameworks, including ISO 27001, the EU Cyber Resilience Act, BSI IT-Grundschutz, and SLSA. This capability helps organizations demonstrate adherence to security standards by providing structured documentation of their supply chain practices. The platform aims to simplify the process of maintaining compliance across multiple jurisdictions and industry standards.

Detection notes

Security operations teams should monitor for centralized logging of scan results and changes in vulnerability status. Look for automated alerts triggered by new CVEs matching project dependencies or failed package downloads blocked by proxy rules. Check whether VEX statements are being applied consistently to reduce false positives. Verify that findings are syncing correctly with issue trackers to ensure developers are aware of risks. Containment moves involve verifying the integrity of SBOMs and ensuring that blocked packages are not bypassed in CI/CD pipelines.

Background: CI/CD pipeline vulnerabilities

CI/CD pipeline vulnerabilities occur when attackers exploit weak authentication, unsecured secrets, or insecure build steps. They move from source code to production by poisoning artifacts or hijacking runners. You can interrupt this flow by enforcing least privilege, scanning artifacts, and verifying every stage before deployment.

Read the full guide: CI/CD Pipeline Vulnerabilities: How Attackers Move From Code to Production

What to do and how to stay safe: DevGuard

• Review current supply chain scanning tools to see if consolidating them into a single platform reduces operational overhead.
• Verify that your organization can self-host security tools if data privacy or compliance requirements prevent cloud-based solutions.
• Check whether your development workflows support bidirectional syncing with issue trackers to streamline vulnerability triage.
• Ensure that your team has processes for managing VEX statements to accurately assess the impact of new CVEs.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is DevGuard a commercial product or open source?

DevGuard is a free, open-source platform that is part of the OWASP Incubating Project.

Can I use my existing scanners with DevGuard?

Yes, teams can upload CycloneDX SBOMs or SARIF results from tools like Trivy, Grype, or Semgrep instead of using the built-in scanners.

Which issue trackers does DevGuard support?

DevGuard syncs findings with GitHub Issues, GitLab Issues, and Jira.