DepWarden Maven plugin

The DepWarden Maven plugin (sca-maven-plugin) is a standard Maven Mojo that hooks into the verify lifecycle. It resolves your full dependency graph (including BOMs, parent POMs, and scope inheritance), sends the package-coordinate list to the DepWarden API, and writes reports to target/sca-reports/. Published on Maven Central — version 1.0.5 is live and resolvable by any Maven build, with no extra repository configuration.

Prerequisites

Maven ≥ 3.6
Java ≥ 11
Network access to DepWarden.in (or self-hosted)

Install and run

1. Add to pom.xml

<build>
  <plugins>
    <plugin>
      <groupId>io.github.rushabh5000</groupId>
      <artifactId>sca-maven-plugin</artifactId>
      <version>1.0.5</version>
      <configuration>
        <apiKey>${env.APP_API_KEY}</apiKey>
        <!-- Optional overrides below -->
        <projectName>my-service</projectName>
        <failOnSeverity>high</failOnSeverity>
        <formats>html,pdf,json</formats>
      </configuration>
      <executions>
        <execution>
          <id>scan</id>
          <phase>verify</phase>
          <goals><goal>scan</goal></goals>
        </execution>
      </executions>
    </plugin>
  </plugins>
</build>

Bind to the verify phase to run after all dependencies are resolved.

2. Set your API key

export APP_API_KEY=dw_xxxxxxxxxxxxxx

Or set it in ~/.m2/settings.xml under <server> if you prefer to keep it out of CI logs. Use DEMO for free trial scans.

3. Run a scan

mvn verify

# Or run the goal directly without a full build:
mvn sca:scan

4. Gate on severity

# Fail the build if any HIGH or CRITICAL vuln is found:
mvn sca:scan -Dsca.failOnSeverity=high

Accepted values: none, low, medium, high, critical. Default: none (never fails).

Configuration

apiKey (default ${env.APP_API_KEY}) — Your DepWarden API key. Use DEMO for three free full-fidelity scans.
projectName — Project name sent to DepWarden. Defaults to groupId:artifactId.
failOnSeverity (default none) — Fail the Maven build if any vulnerability at this severity or higher is found. Values: CRITICAL, HIGH, MEDIUM, LOW, NONE.
formats (default html) — Comma-separated list of report formats to write: html, pdf, xlsx, json, csv.
reportTypes (default risk-summary) — Comma-separated report types to write: risk-summary, vulnerability-detail. Combined with formats as a full cross-product.
out (default target/sca-reports) — Directory where reports are written.
failOnError (default true) — Fail the build when the server gate result is "fail". Ignored when failOnSeverity is set.
apiUrl (default ${env.APP_API_URL}) — Override API base URL for self-hosted deployments.

Failing the build

Set <failOnSeverity>HIGH</failOnSeverity> in the configuration (or pass -Dsca.failOnSeverity=high) to exit non-zero when a HIGH+ vulnerability is found. The plugin exits 0 when only findings below the threshold are present. Values: CRITICAL, HIGH, MEDIUM, LOW, NONE (default).

Report formats

HTML (default)
PDF
Excel (XLSX)
JSON (CycloneDX SBOM)
CSV

Every scan can also export a CycloneDX SBOM.