DevGuard

DevGuard is a software supply-chain security platform for teams that want vulnerability response, dependency controls and release safeguards connected to development work. It is best suited to developers, DevOps engineers and security-conscious teams able to use its self-hosted public-project tier or commit to managed SaaS. The breadth is a strength; the free tier’s project restriction and Business plan’s annual billing make eligibility and commitment central to the decision.

Overview

DevGuard connects GitLab and GitHub repositories with CI pipelines and issue trackers, and can ingest SBOM, VEX and SARIF data from compatible scanners and tools. That makes it a plausible fit for teams seeking to coordinate existing security inputs rather than replace every scanner. The project is open source under AGPL-3.0-or-later, with source code distributed by L3montree GmbH and DevGuard Contributors.

Its focus extends beyond finding issues: it monitors deployed software for newly disclosed vulnerabilities and can create issues when new CVEs affect software. That links detection to remediation, though teams still need to decide whether the self-hosted or paid operating model fits their projects.

Key features

Vulnerability and risk management

Risk scoring and exploit-probability analysis help prioritize findings, while VEX assessment sharing can reduce false positives by clarifying applicability. These capabilities matter most to teams managing ongoing exposure across deployed software, where an unprioritized stream of CVEs can obscure the work that needs attention first.

Dependency and release controls

The devguard-scanner CLI supports software composition analysis, static application security testing and signing attestations. DevGuard also supports SBOM management, build provenance, artifact signing, provenance attestations and release policy gates. The dependency firewall checks npm, Go, PyPI and container image requests against a malicious-package database and blocks known-bad releases. Together, these controls cover both dependency intake and release integrity; the range is attractive to teams that want those jobs in one security workflow.

Security and compliance

DevGuard helps teams address software-development requirements associated with ISO/IEC 27001 and PCI-DSS. That is useful as part of a broader compliance effort, but it should not be mistaken for a guarantee of compliance.

Pricing

Open Source costs nothing, billed Lifetime. It includes all features, community support and self-hosting, but is limited to public projects with an OSI-approved license. Non-commercial FLOSS projects can get SaaS free. This is a meaningful free option for eligible open-source work, not a general-purpose free tier for private commercial projects.

Business SaaS costs €449.10 a month on a 1 year contract, paid yearly. It includes 10 users, 4 hours of monthly support, fully managed hosting in Germany, a 1-hour setup workshop and 8×5 email support. The managed deployment and onboarding suit teams that do not want to host the platform themselves; the annual commitment and ten-user allowance are material constraints for smaller or rapidly changing teams. A 14-day trial is offered.

Enterprise has custom pricing, with unlimited users, projects and assets, a custom SLA, phone and chat support, and on-premises or cloud deployment. It is the tier for organizations that need broader capacity or deployment and support options, with price determined by custom quote.

The cheaper Open Source tier gives up managed hosting and paid support, and its public-project rule excludes ordinary private commercial use. Business adds those operational benefits but requires yearly payment and caps included users at 10; Enterprise removes stated capacity limits and adds deployment and support choices.

Platforms

DevGuard supports API, Linux, macOS, self-hosted, web and Windows. Self-hosting is available on the free Open Source plan; Business SaaS is fully managed and hosted in Germany, while Enterprise can be deployed on-premises or in the cloud.

Who it's for

Developers, DevOps engineers and security-conscious teams are the intended users. DevGuard is a strong candidate for teams already producing SBOM, VEX or SARIF data that want vulnerability prioritization, dependency blocking and release controls connected to repositories and issue tracking. Public-project maintainers can use the free self-hosted tier; non-commercial FLOSS projects have a route to free SaaS. Private commercial teams should weigh the annual Business commitment against their headcount and support needs.

Pros and cons

Broad supply-chain coverage: vulnerability monitoring, dependency firewall checks, SBOM management, signing and release gates address several stages of the software lifecycle.

Works with existing security inputs: SBOM, VEX and SARIF ingestion can make it useful alongside compatible scanners rather than requiring a single-tool workflow.

Free full-featured self-hosting for eligible projects: the Open Source plan includes all features, but only for public projects with an OSI-approved license.

Managed Business service: Germany-based hosting, setup assistance and monthly support hours reduce hosting work, but the annual contract and 10 included users limit flexibility.

Support differs sharply by tier: community support comes with Open Source; paid support hours and 8×5 email are reserved for Business, with phone and chat at Enterprise.

Alternatives

Compare software supply-chain security software if you want to consider a wider set of products. Choose Sonatype Nexus Repository if repository management is the priority: its free Community Edition includes full ecosystem support, CI/CD integration and an external PostgreSQL option. ActiveState Platform is another freemium option, with a free organization tier limited to public projects and a paid organization tier with custom pricing.

Wisec may suit teams whose needs fit its free tier of 3 projects, 1,000 builds per month, 30 days of history and one PDF certificate per month. StepSecurity is worth considering for teams centered on GitHub Cloud runners: its free Community plan covers unlimited public repositories and GitHub-hosted runners, with community support. SafeDep Platform offers an open-source route through Vet, PMG, xBom and Gryph, usable without a SafeDep account.

GUAC is a free open-source option under the MIT license, though setup requires Docker, Docker Compose and jq. Chainloop offers a free, self-hosted Community Edition, but without a UI or curated policy library. JFrog Artifactory is another freemium alternative.

Verdict

Choose DevGuard if your team wants vulnerability monitoring tied to dependency and release safeguards, especially when it can benefit from SBOM, VEX or SARIF inputs already in your workflow. Its strongest advantage is the breadth from risk triage through dependency blocking and artifact signing. Look elsewhere if your private commercial project needs a free tier, or if a one-year Business contract and ten included users do not fit your budget or scale.