Wiring a dependency vulnerability scan or static code analysis into your workflow usually means creating an account, generating a long-lived token, and adding a secret to your repo settings. DepWarden takes a different path: connect a repo branch with a personal access token, run the scan once, and optionally schedule it to repeat — no account, and the token isn't retained beyond what the scan needs.
Paste a GitHub or Azure DevOps repo URL and a PAT, pick the branch, and DepWarden pulls the manifest (or lets you pick which file to scan) and runs a full SCA pass in your private session. Nothing is checked out to disk on our side beyond the manifest text needed for the scan.
For a repo you care about tracking over time, attach a schedule — daily, weekly or monthly — and DepWarden re-scans the branch automatically and emails a report to the address you give it. New CVEs disclosed against packages you already depend on show up on the next run without you doing anything.
The same connected-repo flow also runs DepWarden's SAST engine against the source: SQL injection, XSS, hardcoded credentials, weak cryptography, framework misconfigurations and 300+ more rules across 15 languages, with taint analysis to keep false positives low.
npm, PyPI, Maven, Gradle, Go, Rust, Ruby, .NET, PHP, Dart, Swift — manifests, lockfiles and CycloneDX/SPDX SBOMs.
SCA (dependencies): CVEs from OSV enriched with CISA KEV and FIRST EPSS; typosquatting and dependency confusion; EOL release lines; deprecated packages; OpenSSF Scorecard health; license risk.
SAST (source code): SQL injection, NoSQL injection, OS command injection, XSS — with taint analysis that traces user input to the dangerous sink; hardcoded API keys and private keys; insecure configuration; framework-specific rules for Express, Spring Boot, Django, Rails, Laravel, ASP.NET Core.
The manifest and source text needed for a scan are processed in a session-isolated workspace. No source code is stored beyond a scan, no account is linked, and workspaces are cleared automatically after 30 days or on demand. Related: software composition analysis, SAST scanner, detect typosquats in CI, free vulnerability scanner.