Snyk is an excellent commercial SCA platform. But if you want to scan a dependency tree right now without creating an account, connecting a repo, or sending your project to a vendor cloud, DepWarden is a free, anonymous alternative. You paste a manifest, a lockfile or an SBOM — or point it at a public repo — and it runs in a private, session-isolated workspace, receiving only the dependency manifest text, never your source. Here is an honest comparison.
Every component is matched against the full OSV mirror, then enriched with CISA KEV (actively exploited in the wild) and FIRST EPSS (exploit probability). Instead of a wall of CVSS scores you get a short "fix these first" list that says *why* a finding is first — actively exploited, a fix exists, and it is a direct dependency. That prioritisation is the part commercial tools meter; here it is free.
Not just "a CVE exists" but a batch plan — upgrading 3 packages clears 7 findings — with a copy-paste fix command for your ecosystem, and a warning when the suggested version crosses a major boundary.
Ingest an existing CycloneDX or SPDX SBOM, then export a CycloneDX SBOM, an OpenVEX document and a NOTICE / license-obligations file. No add-on module, no gated tier.
Connect a GitHub, GitLab, Bitbucket or Azure DevOps repo branch with a personal access token and attach a schedule — daily, weekly or monthly. It re-scans automatically and emails a report, and no token is retained beyond the scan.
npm, PyPI, Maven, Gradle, Go, Cargo, Composer, RubyGems, NuGet, Dart (Pub) and Swift — as manifests, lockfiles or CycloneDX/SPDX SBOMs.
To be fair: Snyk offers source-level reachability (is the vulnerable function actually called?) and automated fix pull requests via a GitHub app. Both require read — and for fix PRs, write — access to your source. DepWarden deliberately does neither; they are incompatible with the no-account, no-source-upload promise. If you need reachability or auto-fix PRs and are comfortable granting that access, a commercial tool is the right call.
Paste a package-lock.json with an old lodash and a typo'd package name — you will see prioritised fixes, the typosquat flag and a one-command remediation in seconds. No sign-up. More: software composition analysis, free vulnerability scanner, free SBOM scanner, DepWarden vs Black Duck, DepWarden vs Mend.