OWASP Incubating Project DevGuard Offers Unified Supply Chain Vulnerability Management

The OWASP Foundation has released DevGuard, a free and open-source vulnerability management platform designed for the software supply chain. According to Help Net Security, this new OWASP Incubating Project allows organizations to self-host the system, collecting security findings in one location. The platform ranks these findings by risk and tracks them over time, providing a centralized view of project security posture for development teams.

DevGuard operates through a single command-line interface that wraps existing open-source tools to perform six distinct types of scans. These capabilities include secret scanning, static code analysis, dependency checks against known CVEs, infrastructure-as-code checks, container scanning, and license compliance checks. Teams that already utilize tools like Trivy, Grype, or Semgrep can bypass the built-in scanners. Instead, they can upload CycloneDX SBOMs or SARIF results directly into the DevGuard system for processing.

Integration and Workflow Features

The platform synchronizes findings bidirectionally with popular issue tracking systems, including GitHub Issues, GitLab Issues, and Jira. This integration allows developers to triage security alerts using slash commands directly within their existing workflows. A key feature is the Dependency Firewall, which proxies npm, Go, and Python registries. This component blocks known-malicious and vulnerable packages before they are downloaded, preventing compromised dependencies from entering the build environment.

DevGuard also handles VEX, or Vulnerability Exploitability eXchange, data. This feature allows teams to state whether a product is actually affected by a specific CVE. By using reusable VEX rules, organizations can dismiss recurring false positives once, applying that dismissal across all projects. The platform publishes SBOM and VEX data at live links that automatically update when new CVEs are identified, ensuring current threat intelligence.

Compliance and Reporting

The tool generates evidence for several major regulatory and security standards. According to the source material, DevGuard produces documentation for ISO 27001, the EU Cyber Resilience Act, BSI IT-Grundschutz, and SLSA. This helps organizations demonstrate compliance with these frameworks without manual evidence collection. The system is designed to support the growing need for automated compliance reporting in software development lifecycles.

What should you do?

Security teams should evaluate whether their current vulnerability management processes benefit from centralized tracking. Organizations should check if they can integrate DevGuard with their existing CI/CD pipelines and issue trackers. Teams should also assess their need for VEX support to manage false positives efficiently. Finally, users should verify that their self-hosting infrastructure meets the requirements for running the platform.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: DevGuard

• Review your current vulnerability management workflow to identify gaps in tracking and risk ranking.
• Determine if your team can upload existing SBOMs or SARIF results to centralize findings.
• Evaluate the need for a Dependency Firewall to block malicious packages at the registry level.
• Check if your compliance requirements align with the evidence generated by the platform.

Step-by-step guide: Detect CI/CD Pipeline Vulnerabilities: Signals, Blind Spots and Tools

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is DevGuard free to use?

Yes, DevGuard is a free, open-source vulnerability management platform that anyone can self-host.

What types of scans does DevGuard perform?

It runs secret scanning, static code analysis, dependency checks, infrastructure-as-code checks, container scanning, and license checks.

Can I use my own scanning tools with DevGuard?

Yes, teams can upload CycloneDX SBOMs or SARIF results from tools like Trivy, Grype, or Semgrep instead of using built-in scanners.