A free, anonymous GitHub Advanced Security alternative for private repos

By Rushabh Shah, Senior Software Developer · 2026-09-07

Dependabot alerts and CodeQL scanning are free on public GitHub repos — genuinely useful, and genuinely free. The catch is private repos: the same capability, now split into two paid products, Code Security ($30 per active committer/month) and Secret Protection ($19 per active committer/month), billed per committer rather than per repo. For a small private repo with a handful of contributors that's a real, ongoing cost just to see what a scan finds — and it only works inside GitHub in the first place.

DepWarden is a free, anonymous alternative that works on any repo, public or private, hosted anywhere. Paste a manifest, a lockfile, or an SBOM — or point it at a GitHub, GitLab, Bitbucket or Azure DevOps repo — and get results in seconds, in a private, session-isolated workspace. No account, no per-committer billing, and it never receives your source code — only the dependency manifest text.

Exploitability-first prioritization

Every component is checked against the full OSV mirror, then enriched with CISA KEV (actively exploited) and FIRST EPSS (exploit probability) — a short "fix these first" list instead of a raw CVE count, free on every scan.

What GitHub Advanced Security does that DepWarden deliberately doesn't

To be fair: CodeQL's semantic code analysis (tracing actual data flow through your source, not just matching dependency manifests) and Dependabot's native auto-merge/auto-PR workflow are real strengths of staying inside one platform you already use for everything else — no separate tool, no separate login, findings show up right where your team already works. If your whole workflow already lives in GitHub, that native integration is a genuine advantage.

What DepWarden covers on every scan, free, on any host

Typosquat and dependency-confusion detection, OpenSSF Scorecard health, deprecated and end-of-life packages, plus a full compliance round-trip — ingest an existing CycloneDX or SPDX SBOM, export a CycloneDX SBOM, an OpenVEX document, and a NOTICE / license-obligations file. Works identically whether the repo lives on GitHub, GitLab, Bitbucket or Azure DevOps.

Repeat scans with no per-committer billing

Connect a repo branch with a personal access token and attach a schedule — daily, weekly or monthly — and DepWarden re-scans it automatically and emails a report. No token retained beyond the scan, and the cost doesn't scale with headcount.

Try it: paste a package-lock.json from a private repo and see prioritized findings in seconds — no sign-up, no per-seat cost.