Release · Hub
The depproof hub — org-wide governance, waivers & audit trail
The scanner audits one repo. The depproof hub rolls every repo’s scans into one cross-repo view — and now adds cybersec-owned waivers with an append-only audit trail. It’s self-hosted in your own network; your reports never leave your infrastructure.
Released 29 Jul 2026 · see the changelog
One view across every repo
Your CI scans push their reports into the hub, and it turns dozens of isolated results into one queryable inventory your security and compliance teams can actually govern from:
- Org-wide dashboard — every repo’s findings, gate status, and policy posture in one place, worst first.
- Cross-repo blast-radius search — “is this newly disclosed CVE anywhere in our estate, and where?” answered in one query, not an archaeology dig.
- Org-wide license posture — which repos and products ship which licenses, and where a prohibited or copyleft license has crept in.
New: waivers with an audit trail
Not every finding can be fixed today — sometimes there’s no upstream fix, or it isn’t exploitable in your context. The hub now lets your security team accept that risk deliberately and defensibly instead of muting it in a spreadsheet:
- Cybersec-owned waivers — waive a finding from the repo page with a justification and an expiry, so risk acceptance is a decision with an owner and a clock, not a permanent mute.
- Append-only audit trail — every waiver and change is recorded with its history and a posture snapshot: the evidence an auditor asks for.
- OpenVEX & CSV export — hand a machine-readable VEX statement to downstream teams and customers, or a CSV to your GRC process.
New to the concept? VEX and vulnerability waivers explained covers what a Vulnerability Exploitability eXchange statement actually is, how to handle a finding you can’t fix yet, and why time-bound, audited risk acceptance beats a blanket suppression.
Waive once — stop failing every build
The waiver isn’t just a dashboard note. With online-mode enabled, the scanner fetches the hub’s active waiver set at scan time, so a finding your security team has centrally accepted no longer fails that repo’s CI gate — while the raw SBOM and report stay untouched. It’s fail-closed: if the hub is unreachable, no waivers apply and the gate stays strict, so an outage can never silently turn a red build green.
Self-hosted, and yours
The hub deploys inside your own network and you own it outright. Your scan reports, findings, and the aggregate view never leave your infrastructure — the same self-hosted posture as the scanner, extended to the org-wide layer. It ingests the scanner’s standard report format and holds no repo credentials.
Who it’s for
- Compliance & GRC — a defensible, exportable record: waivers, audit trail, OpenVEX, and coverage across the estate.
- Cybersecurity teams — own risk acceptance centrally, enforce it in CI, and answer “where is this CVE?” across every repo.
Honest scope
- The hub reads; the scanner writes. It aggregates the reports your CI scanner pushes — run the scanner first.
- A paid product, self-hosted. The hub is a depproof product you add to the scanner, deployed in your network — not the free public scanner image.
- Hardening. SSO/OIDC has since shipped. An approval workflow over waivers is on the way; we’ll say what’s shipped and what isn’t.
Or write to hello@depproof.com.
The hub is software composition analysis at the org-wide layer — see pricing and follow releases on the changelog (RSS).