FAQ
Straight answers.
Including the parts most vendors gloss over — what isn’t built yet, and when you might not need us.
What does depproof actually do today?
It resolves the full transitive Maven/Gradle dependency tree without running your build, checks every dependency’s license and OSV advisory data against a policy you define, and produces a self-contained HTML report plus a CycloneDX SBOM — as a GitHub Action or a single self-hosted container.
Which ecosystems are supported?
JVM first — Maven and Gradle — because that’s where accurate, no-build transitive resolution is hardest and most valuable. npm, PyPI and Go are on the roadmap, added deeply rather than broadly. Language is our beachhead, not the moat.
Do you need my source code or send it anywhere?
No. depproof runs inside your perimeter — in your CI or on your machine. Your code and your findings never leave it. There is no depproof cloud to send data to and no subprocessor to add to a vendor review.
Why open data (OSV) instead of a proprietary vulnerability database?
Proprietary databases lock your findings to one vendor and can’t be independently audited. depproof builds on OSV.dev — open, portable advisory data — so you can switch tools or hosts and keep your governance. Better data underneath, no lock-in on top.
How is the pricing different?
It’s flat per site — never per seat, per committer, or per application — and free for open source and organizations under $1M in revenue. Per-seat pricing pushes teams to under-scope coverage; flat pricing lets you scan 100% of your repos without a budget penalty.
Do you have an org-wide dashboard and blast-radius search?
Not yet. Org-wide aggregation and cross-repo blast radius are table stakes that the incumbents already ship — we’re building our version (the depproof-hub control plane, self-hosted so evidence stays in your perimeter), and we’d rather tell you it’s roadmap than pretend it’s live.
How is this different from Snyk, Nexus, or GitHub/GitLab governance?
Snyk is powerful but SaaS and per-developer. Nexus is self-hostable but heavy and per-application. GitHub/GitLab governance is native but locks you to one host and its premium tier. depproof is the host-agnostic, self-hosted, flat-priced, open-data option you don’t need a platform team to run. If you’re happily all-in on one of those, you may not need us — and we’ll say so.
Is it heavy to operate?
No. It’s a single ~31MB container with no database and no server to keep running. It scans and exits. That’s deliberate — the self-hostable alternative in this category needs a server, database, HA, and Java expertise to babysit.
How accurate is the JVM dependency resolution?
depproof resolves the complete transitive tree with Aether — the resolver the Maven ecosystem is built on — with no build step and no lockfile required. That avoids the caveats you hit elsewhere, where accurate transitive resolution needs a successful build or dependency-submission.
Still weighing it up?
Tell us about your estate — hosts, ecosystems, constraints — and we’ll be honest about whether depproof is the right fit.