Notes on free, privacy-first software composition analysis, supply-chain security and CI dependency scanning. DepWarden is a free, anonymous SCA tool: it scans your dependencies against live OSV, CISA KEV and FIRST EPSS data, catches typosquats and dependency confusion, and ranks every finding by real-world exploitability — no account, no source upload.
These articles go deeper on the topics that matter for modern dependency security: how to evaluate a software composition analysis tool, why exploitability-first prioritisation (CISA KEV + FIRST EPSS) beats triaging a wall of CVSS scores, how to block typosquatting and dependency-confusion attacks in continuous integration before a malicious package runs, and how a free, anonymous scanner compares to paid platforms like Snyk, Black Duck and Mend. Each post is practical and tool-agnostic — you can apply the ideas with DepWarden or anything else.
Software supply-chain security has moved from a niche concern to a board-level one. The overwhelming majority of the code in a modern application is open source you didn't write, pulled in transitively through dozens of layers of dependencies. That is enormous leverage for productivity and an equally large attack surface: a single compromised or abandoned package can expose every application that depends on it. The posts below focus on the practical, low-cost controls that actually reduce that risk — continuous dependency scanning, prioritising by real exploitability rather than raw severity, catching malicious packages that have no CVE, and turning a bill of materials into an ongoing assessment instead of a one-time snapshot.
New to the topic? Start with our overview of what software composition analysis is, then try the free vulnerability scanner on one of your own lockfiles.