A severity threshold alone ships the vulnerability attackers are using: plenty of actively-exploited findings are rated only medium. The CI gate now takes exploitation evidence, CVSS score, and whether a fix exists — and a new fidelity rule fails the build when the dependency graph could not be fully resolved, the one case where a short findings list is the warning rather than the all-clear.
Fail on findings CISA lists as known-exploited, whatever their severity — or on modelled exploitation probability (EPSS). Exploitation data is served by your own self-hosted hub.
Gate on a CVSS base score, and separately on findings that could not be graded at all — an ungraded advisory is no longer silently treated as low.
Narrow any rule to findings with a known fix, so a build fails on what your team can act on today. Excluded findings are still counted and reported, never dropped.
Fidelity gate — fail when a dependency graph was never fully resolved. The only rule that can fail a build with an empty findings list, which is the point.
A Markdown run summary for any CI, a GitHub job summary, and a PR comment updated in place rather than one per run.
Scanner
Go module support
The scanner now audits Go projects alongside Java, JavaScript, and Python — the resolved module graph checked against OSV advisories for Go, licenses classified to SPDX, and Go components included in the CycloneDX SBOM and the CI gate. Same self-hosted container; your source never leaves your runner.
Go modules resolved from the project’s own module graph, with a go.mod fallback
Known-vulnerability detection for Go packages on open data (OSV.dev)
Go dependency licenses classified and normalized to SPDX
Go components in the CycloneDX SBOM and the pass/fail CI gate
Hub
The depproof hub — org-wide governance, waivers & audit trail
The self-hosted hub aggregates every repo’s scan reports into one cross-repo view — blast-radius search and org-wide license posture — and adds cybersec-owned waivers with an append-only audit trail (posture snapshots, expiry, OpenVEX/CSV export). A centrally-accepted finding stops failing every repo’s CI. Runs in your own network; reports never leave your infrastructure.
Org-wide dashboard — every repo’s findings, policy, and blast radius in one view
Cross-repo blast-radius search — find a CVE anywhere in your estate
The depproof scanner — self-hosted dependency & license audit
Audit your dependencies for known vulnerabilities and license risk across Java (Maven, Gradle), JavaScript/Node (npm, pnpm, yarn, bun), and Python (PyPI) — the full transitive tree, a CycloneDX SBOM, and a pass/fail CI gate. Runs self-hosted in GitHub Actions, GitLab CI, or any container; your source never leaves your runner.
Ecosystems: Maven (no build), Gradle (post-build), npm/pnpm/yarn/bun (from the lockfile), Python (from the lockfile)
Known-vulnerability + malicious-package detection on open data (OSV.dev)
Every dependency’s license classified and normalized to SPDX
CycloneDX SBOM + a self-contained HTML report
Pass/fail CI gate — fail-on: critical | high | medium | low | none
Zero-config in GitHub Actions and GitLab CI — self-hosted, no source uploaded