depproof
depproof.com
Spec sheet
- Purpose
- depproof provides self-hosted software composition analysis for Java, JavaScript, Python, and Go dependencies.Read 11 Oct 2026 · depproof.com
- Intended users
- The maker describes the Hub as for regulated teams, growing repository estates, and teams that need data deployed within their own network.Read 11 Oct 2026 · depproof.com
- Integrations
- The getting-started page describes a GitHub Action and says the container can be used with GitLab CI, Jenkins, or locked-down pipelines.Read 11 Oct 2026 · depproof.com
- Support
- For Scanner licenses over $1M revenue, the pricing page lists priority support and upgrade guidance; the Hub includes SLA and onboarding support.Read 11 Oct 2026 · depproof.com
- Advisory data
- The scanner checks components against open OSV advisory data.Read 11 Oct 2026 · depproof.com
- CI options
- The scanner is available as a GitHub Action or a self-hosted container for CI pipelines.Read 11 Oct 2026 · depproof.com
- Coverage reporting
- Each scan reports how much of the dependency tree it resolved and can fail the build when coverage is insufficient.Read 11 Oct 2026 · depproof.com
- Data handling
- The privacy policy says the scanner does not send source code, dependency data, SBOMs, or scan findings to the company or third parties.Read 11 Oct 2026 · depproof.com
- Dependency coverage
- The scanner resolves transitive dependencies and checks components for known vulnerabilities and license obligations.Read 11 Oct 2026 · depproof.com
- Hub governance
- The Hub offers cross-repository blast-radius search, organization-wide license posture, current CycloneDX SBOMs, and waivers with owners, expiries, and an append-only audit trail.Read 11 Oct 2026 · depproof.com
- Notable limitation
- The product says it does not scan container or operating-system packages.Read 11 Oct 2026 · depproof.com
- Scan output
- Each run can produce a self-contained HTML report, a CycloneDX SBOM, and a pass/fail policy gate.Read 11 Oct 2026 · depproof.com
- Supported inputs
- The homepage lists pom.xml, gradle.lockfile, package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, and go.mod.Read 11 Oct 2026 · depproof.com
Plans and prices
Scanner Free Free for open source and organizations under $1M revenue · over $1M revenue, license adds priority support, upgrade guidance, and policy templates Read 11 Oct 2026 · depproof.com
Hub Priced on request Custom; added to the Scanner Org-wide dashboard and cross-repository blast radius · license posture and current SBOM · waivers with append-only audit trail · SSO/OIDC · SLA and onboarding support · SBOM retention in development Read 11 Oct 2026 · depproof.com
Where Specifiction places it
- Software Composition Analysis Software#35 of 657.7
Alternatives to depproofAll alternatives →
Endor Labs Free plan 8.9 Visit 
DepWarden From $19/mo · Free plan 8.7 Visit 
Eclipse Steady Free plan 8.6 Visit 
Mend SCA From $20.83/mo 8.6 Visit 
Scantist Free plan 8.6 Visit