DevGuard

DevGuard is an open-source platform for securing software supply chains, aimed at developers, DevOps engineers and security-conscious teams. It is a strong fit for teams that want vulnerability response and release controls in one workflow, but the free plan’s project restriction and Business SaaS’s annual commitment limit who can use it on those terms.

Overview

DevGuard connects GitLab and GitHub repositories with CI pipelines and issue trackers, and accepts SBOM, VEX and SARIF inputs from compatible tools. That makes it useful as a coordination layer for teams already producing security data, rather than a replacement for every scanner. Its source code is distributed under AGPL-3.0-or-later.

It monitors deployed software for newly disclosed vulnerabilities and can create issues when a CVE affects an application. Risk scoring and exploit-probability analysis help teams prioritize response, while shared VEX assessments can clarify whether a finding applies and reduce false positives. The practical strength is linking exposure to follow-up work; the value depends on teams acting on those findings.

Key features

Dependency and release security

The devguard-scanner CLI supports software composition analysis, static application security testing and signing attestations. DevGuard also supports SBOM management, build provenance, artifact signing, provenance attestations and release policy gates, giving teams controls that extend from dependency review to release decisions.

Its dependency firewall checks npm, Go, PyPI and container image requests against a malicious-package database and blocks known-bad releases. This is a targeted safeguard for those ecosystems, not a universal package firewall: teams relying on other package types should not assume they are covered.

Security and compliance

DevGuard is positioned to help meet software-development requirements associated with ISO/IEC 27001 and PCI-DSS. That makes it relevant to teams formalizing supply-chain controls, but it should be treated as support for compliance work rather than a substitute for the broader requirements of either standard.

Pricing

The free Open Source tier is unusually broad on features, but its public-project and license requirements rule it out for ordinary private commercial development. Non-commercial FLOSS projects can get SaaS free. Business is the managed option for teams that need private-project use, but its yearly payment and 10-user allowance make it a substantial commitment; teams needing unlimited scale or a custom SLA should consider Enterprise. A 14-day trial is available.

Platforms

DevGuard supports API, Linux, macOS, self-hosted, web and Windows environments. The self-hosted option suits teams that want to operate the free plan themselves; Business SaaS offers fully managed hosting in Germany.

Who it's for

DevGuard suits development and security teams that need to connect vulnerability triage with dependency safeguards and release governance. It is especially compelling when a team already generates SBOM, VEX or SARIF data and wants to route findings into issue tracking. It is a weaker fit for private commercial projects seeking a free deployment, or for organizations unwilling to take on an annual SaaS contract.

Pros and cons

Pros

• Combines vulnerability monitoring, risk prioritization and issue creation, helping teams connect new exposure to remediation work.
• Supports several supply-chain controls, including dependency blocking, signing attestations, provenance and release policy gates.
• The free plan includes all features for qualifying public projects, while non-commercial FLOSS projects can access SaaS free.

Cons

• The free self-hosted plan is restricted to public projects with an OSI-approved license, excluding typical private commercial repositories.
• Business SaaS costs €449.10 a month on a one-year contract paid yearly, and includes 10 users rather than unlimited seats.
• The dependency firewall covers npm, Go, PyPI and container image requests, so teams using other ecosystems should not rely on it for coverage.

Alternatives

Compare software supply-chain security software if you want to weigh DevGuard against a broader set of tools.

• ActiveState Platform is another freemium option with a free tier limited to public projects; consider it if that model and its API, Linux, macOS, web and Windows support suit your needs.
• Sonatype Nexus Repository offers a free Community Edition with ecosystem support and CI/CD integration. Choose it when repository management and those integrations are the priority.
• Wisec has a free tier capped at 3 projects, 1,000 builds per month, 30 days of history and one PDF certificate per month. It may suit teams whose needs fit within those explicit limits.
• GUAC is a free MIT-licensed open-source project; choose it if that license is preferable and you are prepared to set it up with Docker, Docker Compose and jq.
• SafeDep Platform offers free open-source tools—Vet, PMG, xBom and Gryph—that can be used without a SafeDep account, making it worth considering when standalone tools are the better fit.
• StepSecurity offers a free Community plan with unlimited public repositories on GitHub-hosted runners in GitHub Cloud; it is a relevant alternative for teams centered on that setup.
• Chainloop has a free, self-hosted Community Edition without a UI or curated policy library; consider it if those omissions are acceptable.
• Sigstore is free to use for all developers and software providers, a straightforward alternative when that broad free access is the deciding factor.

Verdict

DevGuard is a good choice for teams that want vulnerability response, dependency screening and release-security workflows connected, especially when they can use the qualifying free plan or justify managed Business SaaS. Its main draw is the breadth of controls across the software supply chain; look elsewhere if private commercial use must be free or if a yearly SaaS commitment does not fit.