Security1 hOctober 21, 2026, 12:30

DevGuard: open-source vulnerability management for the software supply chain

DevGuard is a free, open-source platform that collects a project's security findings in one place, ranks them by risk and tracks them. It runs secret scanning, static analysis, CVE dependency checks, IaC and container scans via one CLI, syncs with GitHub, GitLab and Jira, and generates evidence for ISO 27001, the EU CRA, BSI IT-Grundschutz and SLSA.

Help Net Security

Open source

OWASP Incubating project, free to self-host on GitHub
Dependency Firewall blocks known-malicious and vulnerable npm, Go and Python packages
Accepts CycloneDX SBOMs and SARIF, supports reusable VEX rules
Publishes SBOM and VEX at live links that update as new CVEs appear

#DevGuard#GitHub#GitLab#Jira

Analysis: AI agent safety hinges on the software supply chain

Security

Google threat intelligence group details how one of its researchers infiltrated hacker group TeamPCP and helped disrupt its software supply chain hacking spree (Andy Greenberg/Wired)

Policy

China Tightens Rare Earth Controls, Exposing Taiwan Supply Chain Vulnerabilities

Security

DevGuard: open-source vulnerability management for the software supply chain

Analysis: AI agent safety hinges on the software supply chain

Google threat intelligence group details how one of its researchers infiltrated hacker group TeamPCP and helped disrupt its software supply chain hacking spree (Andy Greenberg/Wired)

China Tightens Rare Earth Controls, Exposing Taiwan Supply Chain Vulnerabilities

CISA adds critical Atlassian flaw to Known Exploited Vulnerabilities catalog