Multi-ecosystem SCA across 17 ecosystems. Native SAST with 400+ rules across 13+ languages, plus IaC and Kubernetes. Secrets detection, container image scanning, attack-path graph, JS/TS reachability, and exploitability intelligence (CISA KEV, EPSS, ExploitDB, exploit-window forecasting). Auto-fix PRs for GitHub and GitLab. AI risk profiling, license compliance, and a Dependency Firewall that blocks risky packages at install time — every decision sealed with a signed JWS attestation. Self-hosted. No vendor lock-in.
SCA, SAST, IaC, secrets, container, attack paths, exploitability fusion, and the Dependency Firewall — with policy gates, auto-fix PRs, and signed evidence.
Resolve direct and transitive dependencies across 17 ecosystems — npm, PyPI, Maven, NuGet, Cargo, Go, RubyGems, Composer, Pub, CRAN, Conda, CPAN, OPAM, CocoaPods, SwiftPM, PEAR, and Bazel — correlated against OSV, NVD, and GHSA.
Fuse CISA KEV, EPSS, ExploitDB, CVSS, and exploit-window forecasting (EWF) to prioritize what's actually weaponized — not just what's listed. Stop chasing CVE counts; chase real risk.
Block risky packages before they're installed across npm, PyPI, Maven, NuGet, RubyGems, Cargo, and Go. Every allow / block / bypass carries a signed JWS attestation, verifiable offline with the public key.
Native code analysis with 400+ rules across 13+ languages, plus IaC for Terraform and CloudFormation (JSON and YAML), and Kubernetes manifest scanning. Taint tracking and AI-context profiling included.
Connect vulnerable dependencies to imports, sinks, and HTTP routes in a scored graph. JS/TS reachability shows whether vulnerable code is actually executed in your call graph — not just declared.
Scan Docker-save tarballs or pull from any OCI registry. Per-layer SBOM, vulnerability correlation across 9 ecosystems inside the image, and base-image upgrade guidance.
700+ rules covering AWS, GCP, Azure, GitHub, Stripe, OAuth tokens, JWTs, and private keys. Findings linked to file and line, with entropy validation to suppress false positives.
Automatic remediation pull requests for GitHub, GitLab, and self-hosted instances — manifest patching, lockfile updates, lockfile regeneration. Policy-as-code with PASS/FAIL exit codes for CI/CD.
A single standalone binary for Windows, Linux, and macOS. No runtime required. One command to scan, one exit code to gate your build.
_|_| _|_|_| _| _| _|_| _| _| _| _| _| _| _|_| _| _| _| _|_| _| _| _| _|_|_| _| _|_| _| _| _| _|_| _| _| _| _| _| _| _| _| _| _|_| _| _| _| _|_| _| _| dpndncY Scan Engine — v2.9.0 ---------------------------------------- 09:45:01 INFO [dpndncy] --- scan.target = /projects/my-app 09:45:01 INFO [dpndncy] --- scan.mode = SCA, SAST 09:45:03 INFO [scan] --- [1/6] Manifest Discovery 09:45:05 INFO [scan] --- [2/6] Dependency Graph 09:45:18 INFO [scan] --- [3/6] Vulnerability Lookup 09:45:47 WARN [results] --- [HIGH] CVE-2023-44487 express@4.18.1 fix: 4.19.2 09:45:47 WARN [results] --- [HIGH] CVE-2024-21538 cross-spawn@7.0.3 fix: 7.0.5 09:45:47 INFO [results] --- [LOW] CVE-2024-4067 micromatch@4.0.5 09:45:48 INFO [policy] --- POLICY FAIL — violations detected 09:45:48 INFO [dpndncy] --- Run complete. View results in the web UI.
dpndncy scan --all .--ci flag for minimal output that won't clutter your pipeline logs.Real screenshots from the platform — dashboard, vulnerabilities, SAST, attack paths, remediation, governance, and integrations.
Choose a scan mode and get dependency risk, code findings, and policy outcomes in one workflow.
Scan a local path, uploaded manifest/zip, GitHub repo, or container image (tarball or registry). dpndncY resolves direct and transitive dependencies, then correlates OSV, NVD, GHSA, EPSS, and CISA KEV.
Use scan mode to enable AI Risk and/or native SAST. dpndncY profiles AI context concentration, structural code risk, and code-level findings for governance and remediation planning.
Attack Paths link vulnerable dependencies to code sinks and reachable entry points. Risk amplification highlights combinations where vulnerable packages and higher AI-context code overlap.
Assess upgrade risk inline before patching, use remediation guidance and patch targets, and export results (CSV, CycloneDX, UBOM, SARIF, PDF) to fix faster and enforce policy in delivery pipelines.
SCA, SAST, IaC, secrets, container, attack paths, exploitability fusion, AI risk, license compliance, auto-fix PRs, and the Dependency Firewall — all under one roof, on your infrastructure, with signed evidence on every decision.
