Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

OWASP dep-scan

Free#22 of 65 in Software Composition Analysis Software

OWASP dep-scan: A broad self-hosted scanner for teams that want open-source dependency and container analysis. Ranked #22 of 65 in Software Composition Analysis Software by our editors (7.1/10); pricing: Free plan; best for self-hosted teams wanting broad scanners.

7.1/10Editor score
Visit OWASP dep-scan
OWASP dep-scan7.1 Visit OWASP dep-scan

At a glance

  • Editor score
    7.1 / 10
  • Pricing
    Free plan
  • Best for
    Self-hosted teams wanting broad scanners
  • Free plan
    Yes
  • Paid from
    Free
  • SBOM generation
    Yes
  • Facts checked
    19 Sep 2026
OWASP dep-scan screenshot

  • Where it wins

    • Covers vulnerabilities, SBOM, VEX, reachability, licenses, and package risks
    • Scans repositories, containers, Kubernetes manifests, and OS packages
    • Runs locally, in Docker, CI environments, or as a self-hosted server

  • Where it doesn't

    • Integration coverage centers on CycloneDX cdxgen and GitHub Security Advisory
    • Pull-request scanning is not established by the published product details
    • Its broad scope may require more operational ownership than narrower tools

Our verdict on OWASP dep-scan

OWASP dep-scan is an open-source software composition analysis tool for developers and AppSec teams that need to inspect application dependencies and related software artifacts. It scans application repositories, dependency manifests, SBOMs, container images, Kubernetes manifests, and operating-system packages. Supported ecosystems include Node.js, Java/JVM, PHP, Python, Go, Ruby, Rust, .NET, Dart, Haskell, Elixir, C/C++, Clojure, Docker/OCI, GitHub Actions, Jenkins, and YAML manifests. It is aimed at teams comfortable with local, CI, Docker-based, API, or self-hosted operation.

Its main strength is breadth. OWASP dep-scan combines dependency vulnerability scanning with SBOM generation, Vulnerability Disclosure Report information, CSAF 2.0/2.1 VEX document generation, and static reachability analysis across supported language ecosystems. It also covers license auditing for dependencies and container images, plus package-risk auditing for dependency confusion and maintenance risks. That combination suits teams that want more than a vulnerability list and need outputs that support inventory, exploitability review, licensing, and supply-chain risk analysis.

The deployment model fits engineering and AppSec groups that prefer control over where scanning runs. It can execute locally, in CI environments, as a container, or in self-hosted server mode across Windows, macOS, and Linux. The listed ecosystem connections include CycloneDX cdxgen and GitHub Security Advisory, while the core tool remains open source and free to run. Teams seeking a broad scanner they can operate themselves should consider OWASP dep-scan; teams prioritizing a larger integration ecosystem or established pull-request workflows may prefer a more specialized alternative.

Your product? Our editors can test OWASP dep-scan in depth and publish a review, labelled as paid · from $149/mo →

OWASP dep-scan pricing

Plans Free planFree Free to use — no paid tier required for the core job.
See plans on owasp.github.io

OWASP dep-scan fact sheet

Free planYes
Paid fromFree
Supported ecosystemsNode.js, Java/JVM, PHP, Python, Go, Ruby, Rust, .NET, Dart, Haskell, Elixir, C/C++, Clojure, Docker/OCI, GitHub Actions, Jenkins, YAML manifests
SBOM generationYes
Reachability analysisYes
Pull request scanningNot verified
Monitored projectsNot verified
Deployment optionsSelf_hosted
DeploymentDesktop, Self-hosted
PlatformsWindows, macOS, Linux
Integrations2 integrations: CycloneDX cdxgen, GitHub Security Advisory
PricingFree plan
Websiteowasp.github.io
Facts checked19 Sep 2026

OWASP dep-scan integrations

OWASP dep-scan lists 2 integrations on its own site.

  • CycloneDX cdxgen
  • GitHub Security Advisory

Alternatives to OWASP dep-scan

See all OWASP dep-scan alternatives →

Used OWASP dep-scan? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used OWASP dep-scan for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

0 characters · at least 80, up to 3,000

Posted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Featured on iTechGuides — OWASP dep-scan 7.1/10

OWASP dep-scan is listed in our Software Composition Analysis Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/owasp-dep-scan/"><img src="https://www.itechguides.com/best/badge/owasp-dep-scan.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update