depproof
depproof: A focused self-hosted SCA tool with a capable free plan and limited ecosystem reach. Ranked #31 of 65 in Software Composition Analysis Software by our editors (6.1/10); pricing: Free plan · pricing on request; best for small self-hosted teams.
At a glance
- Editor score6.1 / 10
- PricingFree plan · pricing on request
- Best forSmall self-hosted teams
- Free planYes
- SBOM generationYes
- Facts checked19 Sep 2026
Where it wins
- Free plan includes transitive resolution, OSV screening, licenses, and SBOMs
- CI and pull-request gates support vulnerability severity policies
- Enterprise adds blast-radius search, waivers, audit trails, and SSO/OIDC
Where it doesn't
- Self-hosted deployment requires teams to manage the operating environment
- Paid Team and Enterprise pricing requires contacting sales
- Supported ecosystems focus on Maven, Gradle, JavaScript, Python, and Go
Our verdict on depproof
depproof is a self-hosted software composition analysis tool for teams working with Java, JavaScript, Python, and Go. It resolves transitive dependencies, screens components against OSV advisory data, classifies open-source licenses, generates CycloneDX SBOMs, and provides pass/fail policy gates for pull requests and CI. The product runs through GitHub Actions or a self-hosted container, while its optional hub supports cross-repository inventory, blast-radius searches, continuous monitoring, waivers, and audit trails. It is aimed at small teams that want dependency governance without per-seat or per-repository billing at the Team tier, and at organizations that require self-hosted control.
The free Open source & small teams plan is available forever and includes the full scanner, license audit, OSV advisories, SBOM generation, a GitHub Action, a self-hosted container, CycloneDX SBOMs, HTML reports, and CI gates based on vulnerability severity. Team adds flat pricing without per-seat or per-repository billing, scanning for all repositories, policy templates, and execution across hosts and CI systems. Enterprise adds a self-hosted control plane, cross-repository blast-radius search, waivers, an append-only audit trail, SSO/OIDC, and air-gap-friendly deployment. The published plans make the free tier a practical starting point, while paid tiers are structured for broader governance.
Integration coverage includes GitHub Actions, GitLab CI, Jenkins, and Docker. Supported ecosystems include Maven, Gradle, npm, pnpm, yarn, bun, PyPI, and Go modules, giving depproof useful reach across common Java, JavaScript, Python, and Go workflows. Its strongest distinction is the combination of transitive dependency resolution, SBOM output, policy gating, and governance features in a self-hosted model. Teams seeking broad ecosystem coverage or a managed deployment should consider alternatives; teams prioritizing self-hosting, focused SCA workflows, and repository-level governance should pick depproof.
Your product? Our editors can test depproof in depth and publish a review, labelled as paid · from $149/mo →
depproof pricing
All 3 depproof plans and prices →
depproof fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Not verified |
| Supported ecosystems | Maven, Gradle, npm, pnpm, yarn, bun, PyPI, Go modules |
| SBOM generation | Yes |
| Reachability analysis | Not verified |
| Pull request scanning | Yes |
| Monitored projects | Not verified |
| Deployment options | Self_hosted |
| Deployment | Self-hosted |
| Integrations | 4 integrations: GitHub Actions, GitLab CI, Jenkins, Docker |
| Pricing | Free plan · pricing on request (source) |
| Website | depproof.com |
| Facts checked | 19 Sep 2026 |
depproof integrations
depproof lists 4 integrations on its own site.
- GitHub Actions
- GitLab CI
- Jenkins
- Docker
Alternatives to depproof
- Snyk Open SourceBroad SCA coverage with reachability, SBOMs, pull-request scanning, and monitoring.9.4
- FOSSAA mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.9.3
- Safeguard SCAA budget-conscious SCA platform with reachability analysis, SBOMs, and remediation workflows.9.1
See all depproof alternatives →
Used depproof? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used depproof for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
depproof is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/depproof/"><img src="https://www.itechguides.com/best/badge/depproof.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update