Mend (formerly WhiteSource) is an enterprise SCA and SAST platform built around automated fix pull requests and an org-wide policy engine — real capabilities if you are managing dependency policy across many repos and teams. Getting there means provisioning an account and installing a GitHub or GitLab app with repo read/write access first.
DepWarden is a free, anonymous alternative for a faster, lower-commitment check. Paste a manifest, a lockfile or an SBOM — or point it at a public repo — and get prioritised results in seconds, in a private, session-isolated workspace. No account, no app installation, and it never receives repo write access, only the dependency manifest text.
Every component is matched against the full OSV mirror, then enriched with CISA KEV (actively exploited in the wild) and FIRST EPSS (exploit probability). Instead of a wall of CVSS scores you get a short "fix these first" list that says *why* a finding is first — actively exploited, a fix exists, and it is a direct dependency. That prioritisation is the part commercial tools meter; here it is free.
Not just "a CVE exists" but a batch plan — upgrading 3 packages clears 7 findings — with a copy-paste fix command for your ecosystem, and a warning when the suggested version crosses a major boundary.
Ingest an existing CycloneDX or SPDX SBOM, then export a CycloneDX SBOM, an OpenVEX document and a NOTICE / license-obligations file. No add-on module, no gated tier.
Connect a GitHub, GitLab, Bitbucket or Azure DevOps repo branch with a personal access token and attach a schedule — daily, weekly or monthly. It re-scans automatically and emails a report, and no token is retained beyond the scan.
npm, PyPI, Maven, Gradle, Go, Cargo, Composer, RubyGems, NuGet, Dart (Pub) and Swift — as manifests, lockfiles or CycloneDX/SPDX SBOMs.
To be fair: Mend's automated fix PRs (opening a PR that bumps a vulnerable dependency for you) and its org-wide policy engine (license allow-lists and severity gates enforced across many repositories) are real, mature capabilities. Both require granting Mend ongoing access to your source and repo settings — incompatible with the model DepWarden is built around. If you need automated remediation at scale, Mend is built for that and this is not.
Paste a package-lock.json with an outdated dependency and see prioritised findings in seconds — no sign-up. More: software composition analysis, free vulnerability scanner, DepWarden vs Snyk, DepWarden vs Black Duck.