Pricing
DepWarden is free to use with no account and no installation — paste a manifest or point a plugin at your build and it reports every known vulnerability, malicious package and licence problem. The free tier writes an HTML report and never blocks a build. SAST static-analysis is included on every tier — no account needed. Paid plans add the parts a team needs to enforce something: PDF, Excel and CSV reports for compliance evidence, failing a build on a severity threshold, transitive fix paths that name which direct dependency to bump, SBOM and VEX export, and scan history. Every plugin works without a key on the free tier, and setting the key to DEMO gives three full-fidelity evaluation scans. Self-hosted and air-gapped deployment are available on Enterprise — every client honours APP_API_URL, so nothing is hard-coded to our servers.
Plans
| Plan | Price (USD) | Built for |
|---|---|---|
| Free | $0 | Report-only scanning with no account and no API key. |
| Developer | $19 / month ($190 / year) | One engineer: all report formats, build gating, fix paths. |
| Team | $99 / month ($990 / year) | A squad: scheduled delivery, VEX, IP-restricted keys. |
| Business | $399 / month ($3,990 / year) | An org: high volume, report branding, long retention. |
| Enterprise | Contract | Contract terms and a self-hosted or air-gapped deployment. |
Try it before you pay
Set the API key to DEMO for three full-fidelity scans — all four report formats, build gating, transitive fix paths and SBOM export. No account or credit card needed. For pricing questions or to buy a plan, talk to us, see the plugins, or read how DepWarden compares in DepWarden vs Snyk.
Questions
Is the free tier really free?
Yes, and it needs no account. It reports every finding and writes an HTML report. It cannot fail a build — that is the line between free and paid.
What do you send to your servers?
Dependency coordinates only. Never your source code. When a plugin runs inside a build it sends the resolved dependency graph, which carries less than a manifest file would — no repository URLs, no internal build config, no developer names.
What counts as one scan?
One submission. A 40-module Maven reactor is a single scan, not forty.
Can I self-host?
Yes, on Enterprise. Every plugin honours APP_API_URL, so nothing is hard-coded to our servers.
How do I pay?
Click "Buy now" on any plan. You'll be taken to a secure Razorpay checkout where you can pay by card, UPI, netbanking, or wallet. Subscriptions renew monthly; you can also choose "Pay once" for a single month with no auto-renewal.