OWASP Dependency-Track vs ReARM

OWASP Dependency-Track is a free, self-hosted platform for managing software-component risk across a supply chain. It builds inventories from software bills of materials and identifies vulnerable components, supporting CycloneDX SBOM, HBOM, VEX, and VDR documents for ingestion, analysis, and production. Components can be matched against NVD, GitHub Advisories, OSV, OSS Index, Snyk, Trivy, and VulnDB, while integrated EPSS support helps prioritize mitigation. Integrity checks flag components when published hashes differ from those served by an upstream registry. A Common Expression Language policy engine evaluates component rules and can break a build when a policy fails. Alerts can be filtered by event fields and sent to Slack, Teams, Mattermost, email, or webhooks. API and web interfaces are available, with least-privilege portfolio access and single sign-on through OpenID Connect, Active Directory, and LDAP. Version 5.1 uses separate API and frontend container images, supports Kubernetes, and requires PostgreSQL.

ReARM is a release governance platform for organizing software composition, security findings, approvals, and evidence around what ships. It versions SBOMs and XBOMs by product, component, and release, with dependency comparisons across versions and search across a portfolio. Releases can retain HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata for 10+ years. Reliza BEAR adds supplier, copyright, and license metadata to SBOMs. ReARM gathers vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools for triage and audit. Release policies can check releases automatically and support manual or automated approvals, recording approver identity, timestamp, and an evidence snapshot in an immutable audit trail. It connects with tools including GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, and Dependency-Track. ReARM Community Edition is self-hosted under AGPL 3.0 and can store and version BOMs without Dependency-Track; vulnerability scanning and policy findings require Dependency-Track or imported VDR files. External deployments require TLS. A free plan is available; paid plans start at $195/mo, and a 60-day trial is listed.