Freedom251 › Software Composition Analysis Software
depproof
What depproof is
depproof is self-hosted software composition analysis for Java, JavaScript, Python, and Go dependencies. Its scanner resolves transitive dependencies and checks components against open OSV advisory data for known vulnerabilities and license obligations. Each scan can produce a self-contained HTML report, a CycloneDX SBOM, and a pass/fail policy gate. It reports how much of the dependency tree was resolved and can fail a build when coverage is insufficient. Inputs include pom.xml, gradle.lockfile, package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, and go.mod, covering Maven, Gradle, npm, pnpm, yarn, bun, PyPI, and Go modules. Teams can run the scanner as a GitHub Action or self-hosted container with GitLab CI, Jenkins, or locked-down pipelines. The privacy policy says source code, dependency data, SBOMs, and findings are not sent to the company or third parties. The optional Hub adds cross-repository blast-radius search, organization-wide license posture, current SBOMs, waivers with owners and expiries, an append-only audit trail, SSO/OIDC, SLA, and onboarding support. Scanner is free for open source and organizations under $1M revenue; Hub pricing is custom.
Who it suits
depproof suits regulated teams, growing repository estates, and organizations that need dependency-analysis data inside their own network. It supports CI pipelines that need SBOMs, policy gates, and coverage checks.
What it does well
- Self-hosted deployment
- Generates HTML reports and CycloneDX SBOMs
- GitHub Action and container options
- Does not send scan data externally
- Supports multiple dependency ecosystems
What to know first
- Does not scan container packages
- Does not scan operating-system packages
- Hub pricing is custom
- Priority support applies to larger Scanner licenses
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Scanner | Free for open source and organizations under $1M revenue · over $1M revenue, license adds priority support, upgrade guidance, and policy templates | Free |
| Hub | Custom; added to the Scanner · Org-wide dashboard and cross-repository blast radius · license posture and current SBOM · waivers with append-only audit trail · SSO/OIDC · SLA and onboarding support · SBOM retention in development | On request |
As depproof.com lists them, read 11 Oct 2026. The maker's own page has the final word.
Verdict
depproof combines dependency vulnerability and license checks with self-hosted data handling. The free Scanner covers core analysis, while the optional Hub adds organization-wide governance features at custom pricing.
Facts from depproof's own pages
- Advisory data
- The scanner checks components against open OSV advisory data. · depproof.com, 11 Oct 2026
- CI options
- The scanner is available as a GitHub Action or a self-hosted container for CI pipelines. · depproof.com, 11 Oct 2026
- Coverage reporting
- Each scan reports how much of the dependency tree it resolved and can fail the build when coverage is insufficient. · depproof.com, 11 Oct 2026
- Data handling
- The privacy policy says the scanner does not send source code, dependency data, SBOMs, or scan findings to the company or third parties. · depproof.com, 11 Oct 2026
- Dependency coverage
- The scanner resolves transitive dependencies and checks components for known vulnerabilities and license obligations. · depproof.com, 11 Oct 2026
- Hub governance
- The Hub offers cross-repository blast-radius search, organization-wide license posture, current CycloneDX SBOMs, and waivers with owners, expiries, and an append-only audit trail. · depproof.com, 11 Oct 2026
- Integrations
- The getting-started page describes a GitHub Action and says the container can be used with GitLab CI, Jenkins, or locked-down pipelines. · depproof.com, 11 Oct 2026
- Intended users
- The maker describes the Hub as for regulated teams, growing repository estates, and teams that need data deployed within their own network. · depproof.com, 11 Oct 2026
- Notable limitation
- The product says it does not scan container or operating-system packages. · depproof.com, 11 Oct 2026
- Purpose
- depproof provides self-hosted software composition analysis for Java, JavaScript, Python, and Go dependencies. · depproof.com, 11 Oct 2026
- Scan output
- Each run can produce a self-contained HTML report, a CycloneDX SBOM, and a pass/fail policy gate. · depproof.com, 11 Oct 2026
- Support
- For Scanner licenses over $1M revenue, the pricing page lists priority support and upgrade guidance; the Hub includes SLA and onboarding support. · depproof.com, 11 Oct 2026
- Supported inputs
- The homepage lists pom.xml, gradle.lockfile, package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, and go.mod. · depproof.com, 11 Oct 2026