depproof

What it does

Advisory data

The scanner checks components against open OSV advisory data.checked 11 Oct 2026

CI options

The scanner is available as a GitHub Action or a self-hosted container for CI pipelines.checked 11 Oct 2026

Coverage reporting

Each scan reports how much of the dependency tree it resolved and can fail the build when coverage is insufficient.checked 11 Oct 2026

Data handling

The privacy policy says the scanner does not send source code, dependency data, SBOMs, or scan findings to the company or third parties.checked 11 Oct 2026

Dependency coverage

The scanner resolves transitive dependencies and checks components for known vulnerabilities and license obligations.checked 11 Oct 2026

Hub governance

The Hub offers cross-repository blast-radius search, organization-wide license posture, current CycloneDX SBOMs, and waivers with owners, expiries, and an append-only audit trail.checked 11 Oct 2026

Integrations

The getting-started page describes a GitHub Action and says the container can be used with GitLab CI, Jenkins, or locked-down pipelines.checked 11 Oct 2026

Intended users

The maker describes the Hub as for regulated teams, growing repository estates, and teams that need data deployed within their own network.checked 11 Oct 2026

Notable limitation

The product says it does not scan container or operating-system packages.checked 11 Oct 2026

Purpose

depproof provides self-hosted software composition analysis for Java, JavaScript, Python, and Go dependencies.checked 11 Oct 2026

Scan output

Each run can produce a self-contained HTML report, a CycloneDX SBOM, and a pass/fail policy gate.checked 11 Oct 2026

Support

For Scanner licenses over $1M revenue, the pricing page lists priority support and upgrade guidance; the Hub includes SLA and onboarding support.checked 11 Oct 2026

Supported inputs

The homepage lists pom.xml, gradle.lockfile, package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, and go.mod.checked 11 Oct 2026