--- title: Mend.io Reviews meta_title: 'Mend.io Reviews 2026: Details, Pricing, & Features | G2' meta_description: Filter 120 reviews by the users' company size, role or industry to find out how Mend.io works for a business like yours. aggregate_rating: rating_value: 4.3 review_count: 120 scale: '5' date_modified: '2026-08-02' parent_category: name: "DevSecOps\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t" url: https://www.g2.com/categories/devsecops --- # Mend.io Reviews **Vendor:** Mend **Category:** [Software Composition Analysis Tools](https://www.g2.com/categories/software-composition-analysis) **Average Rating:** 4.3/5.0 **Total Reviews:** 120 ## About Mend.io Modern risk doesn't live in one layer, it lives between them. Mend.io is built for every risk, across AI and AppSec, securing the code layer, the AI layer, and the interactions between them. From discovery and red teaming to guardrails and runtime protection, Mend.io delivers continuous protection across the entire AI application lifecycle. Mend.io solutions include: 1. Mend AI secures the layer where modern risk actually lives—the interaction between code and AI. It continuously discovers AI components (agents, prompts, models), tests real behavioral risk through automated red teaming, and enforces in-app runtime guardrails for one continuous control system for the AI lifecycle. 2. Mend AppSec secures the modern code layer by continuously discovering and prioritizing risk across code, libraries, containers, and dependencies, giving teams the clarity they need to reduce exposure and ship secure software faster. 3. Mend Renovate secures the foundation of every codebase by automatically updating dependencies, rating the likelihood each update will succeed without breaking changes, and grouping them by confidence level so teams can resolve them faster. ## Mend.io Pros & Cons **What users like:** - Users value the **scanning efficiency** of Mend.io, appreciating its quick and accurate results across multiple repositories. (8 reviews) - Users appreciate the **ease of use** of Mend.io, highlighting simple integration and efficient navigation to find vulnerabilities. (7 reviews) - Users appreciate the **easy integrations** of Mend.io, enabling efficient scanning and streamlined workflows across multiple repositories. (6 reviews) - Users appreciate the **quick and accurate scanning** capabilities of Mend.io, enhancing their development workflow and security. (6 reviews) - Users commend the **excellent automated vulnerability detection** in Mend.io, enhancing efficiency in their CI/CD processes. (6 reviews) - Customer Support (5 reviews) - Users find that Mend.io provides **easy integration support** , enhancing application security effortlessly. (5 reviews) - Comprehensive Solutions (4 reviews) - Security Scanning (4 reviews) - Useful (4 reviews) **What users dislike:** - Users struggle with **integration issues** , finding the setup process for tools like Jira and on-premise systems challenging. (6 reviews) - Users find **limited features** in Mend.io, struggling with functionality and integration challenges for various tools and cases. (3 reviews) - Users note that Mend.io lacks **essential features** , requiring additional tools and workarounds for effective integration. (3 reviews) - Users experience **complex implementation** with Mend.io, citing difficulties in integration and frequent false positives. (2 reviews) - Users find the **confusing interface** of Mend.io awkward, especially when switching between different product portals. (2 reviews) - Users find the product to be **too pricy** , feeling that its integration lacks value for the cost. (2 reviews) - False Positives (2 reviews) - Overwhelming Interface (2 reviews) - Poor Customer Support (2 reviews) - Poor Interface Design (2 reviews) ## Mend.io Reviews ### 1. Good tool for SCA **Rating:** 3.0/5.0 stars **Reviewed by:** Mohit P. | DevSecOps Engineer, Small-Business (50 or fewer emp.) **Reviewed Date:** October 06, 2022 **What do you like best about Mend.io?** 1. Seemless integration with SCM. 2. License management for open source repositories. **What do you dislike about Mend.io?** It would be great if an auto dependency resolution/management is provided for any finding. **What problems is Mend.io solving and how is that benefiting you?** Implementing shift left strategy ### 2. Renovate is great **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Information Technology and Services | Small-Business (50 or fewer emp.) **Reviewed Date:** April 11, 2022 **What do you like best about Mend.io?** I enjoy how quickly PRs are opened so I can always have my dependencies up to date. The PRs are informative and using checkboxes for UI is much better than commands. **What do you dislike about Mend.io?** There isn't much to dislike, the configuration file allows me to control pretty much every I could want to. If I had to make one complaint it's that the config file has to be in the root of the repo. It would be nice if I could hide it away in a .github directory or perhaps a .whitesource directory which could also hold my bolt config file. **What problems is Mend.io solving and how is that benefiting you?** Using whitesource bolt and rebovate, I'm able to keep my dependencies updates and safe. I no longer have to worry about managing my dependencies by hand or by relying on GitHubs automated tools which might miss something. ### 3. Whitesource Fenovate is solid **Rating:** 4.0/5.0 stars **Reviewed by:** Verified User in Education Management | Small-Business (50 or fewer emp.) **Reviewed Date:** March 31, 2022 **What do you like best about Mend.io?** I setup whitesource rennovate to help keep our dependencies up to date. Since doing that we have slowly but surely updated all of our dependencies without spending much developer time. **What do you dislike about Mend.io?** The downside is that rennovate is a bit slow to rerun after you've made a change. For the most part it's fine but when you're getting started and have lots to update it can feel slow. **What problems is Mend.io solving and how is that benefiting you?** Keeping my dependencies up to date for a modern python project that's using poetry and docker. ### 4. Excellent tools **Rating:** 5.0/5.0 stars **Reviewed by:** Gabriel P. | Senior React Developer, Small-Business (50 or fewer emp.) **Reviewed Date:** December 30, 2021 **What do you like best about Mend.io?** I mostly use Renovate, and the difference between its competitors is enormous. Monorepos updates, dependencies dashboard and its response time are what I like the most. **What do you dislike about Mend.io?** Sincerely I cannot think of anything that I dislike. The only improvement I would like is a deeper GitHub integration like they have with Dependabot, but I recognize that it's an effort from both sides. **What problems is Mend.io solving and how is that benefiting you?** My repositories are always updated with the latest dependency versions with minimal effort, which saves a huge amount of time. I'm definitely more productive by using it! ### 5. Easy to use dependency management **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Automotive | Mid-Market (51-1000 emp.) **Reviewed Date:** December 30, 2021 **What do you like best about Mend.io?** We are using WhiteSource's Renovate Bot. It quickly integrates into GitHub Actions, supports private npm registries, and allows grouping of packages which is fantastic if you use TypeScript (you can set up renovate to create one PR for @types package and the related package it self). **What do you dislike about Mend.io?** Right now, there is nothing we dislike about Renovate. It does its job, provides a great developer experience, and makes updating internal core packages more effortless than ever before. **What problems is Mend.io solving and how is that benefiting you?** We are using centralized packages for linting, components, etc.. Renovate makes it easier to ensure that every project uses the latest version of those packages as it automatically creates the update PR's. ### 6. Great bot to keep the app vulnerability free. **Rating:** 5.0/5.0 stars **Reviewed by:** Prateek C. | Software Development Engineer In Test (SDET) [Infosys] , Small-Business (50 or fewer emp.) **Reviewed Date:** September 25, 2021 **What do you like best about Mend.io?** Great app to keep the app vulnerability free as you don't need to worry about upgrading tons of packages in your multiple projects anymore. It does the tedious manual job for you. **What do you dislike about Mend.io?** I've been using renovate for a while now. Don't really know if there's a way to exclude a specific package from upgrading. **Recommendations to others considering Mend.io:** Really easy setup. Smooth integration with git. Keeps your app vulnerability free. Just give it a try. I'm sure you'll find it useful. **What problems is Mend.io solving and how is that benefiting you?** Using Renovate bot to upgrade the dependencies automatically. Biggest benifit is that it keeps the dependencies up to date which helps keeping the app vulnerability free. ### 7. Great tools to help stay on top of the security and updates. **Rating:** 5.0/5.0 stars **Reviewed by:** Sameer P. | Tech Co-Founder, Small-Business (50 or fewer emp.) **Reviewed Date:** February 03, 2022 **What do you like best about Mend.io?** I like how easy it is to get started and running. The security updates that it provide are valuable for the team and helps us move forward quickly. **What do you dislike about Mend.io?** It's hard to setup with private python repo, we had to fork and then use our custom images in the docker to make the renovatebot working on private repos. **What problems is Mend.io solving and how is that benefiting you?** We are solving the updates on the dependencies and also staying on top of the OSS security updates. ### 8. The overall language is amazing **Rating:** 5.0/5.0 stars **Reviewed by:** Daniel N. | IT-Operations Engineer, Small-Business (50 or fewer emp.) **Reviewed Date:** October 19, 2021 **What do you like best about Mend.io?** WhiteSource finds dependency in all our configs, even in those use for pipelines like circle ci. **What do you dislike about Mend.io?** There are no changelogs for Docker containers. If this information is available, it would be helpful to include it in the PRs. A focus on CVEs would also be interesting. **Recommendations to others considering Mend.io:** It's easy to use and I can't think of a project that doesn't benefit from using WhiteSource software. **What problems is Mend.io solving and how is that benefiting you?** We currently use the WhiteSource bot to keep our Github repos up to date. The bot helps us keep all dependencies up to date. ### 9. It just works **Rating:** 5.0/5.0 stars **Reviewed by:** Stef L. | Software Engineer, Mid-Market (51-1000 emp.) **Reviewed Date:** September 06, 2021 **What do you like best about Mend.io?** The WhiteSource Renovate bot is a fantastic product. Setup was effortless, with a friendly guide, in the form of a pull request that shows the impact of your configuration. I had limited the number of open pull requests, so after a few weeks, we were lagging in releasing all the updates. Then renovate bot opened an issue in our project, clearly showing what was still in the backlog. **What do you dislike about Mend.io?** Finetuning how Renovate bot should process updates has quite a bit of a learning curve. **What problems is Mend.io solving and how is that benefiting you?** Renovate bot is helping us keep up to date with all our external software updates. ### 10. WhiteSource's Renovate works great for me **Rating:** 5.0/5.0 stars **Reviewed by:** Risto K. | Senior Emerging Platforms Engineer, Small-Business (50 or fewer emp.) **Reviewed Date:** April 19, 2021 **What do you like best about Mend.io?** I've hooked up Renovate initially to some small repos and now to some big ones, and it's worked great. They've learned from other products in this space and have proper configurability and built-in understanding to make dependency management much easier than manual curation. And they have pretty good documentation. **What do you dislike about Mend.io?** The documentation could be easier to find (it's hidden at the bottom of the page), and could have a softer intro to configuration between "here's the single default config" and "here are all the possible options". Also the docs could be easier to break down by language, as having everything jumbled together isn't the greatest for quickly scanning. But these are minor quibbles, as I've been able to find what I need without much issue once I've gotten used to the docs. **What problems is Mend.io solving and how is that benefiting you?** Renovate really shines for managing two kinds of repos: big ones with complicated dependencies and stable ones that don't otherwise get much attention. Especially for the stable ones, it's great to have deps march forward with full testing simply via approving PRs. ### 11. Renovate bot works nicely **Rating:** 4.0/5.0 stars **Reviewed by:** Ran N. | CTO, Small-Business (50 or fewer emp.) **Reviewed Date:** February 19, 2022 **What do you like best about Mend.io?** The automation of the process of updating **What do you dislike about Mend.io?** The initial setup. Going through a quick wizard would reduce friction of understanding the config options **What problems is Mend.io solving and how is that benefiting you?** Saving time in keeping my software up to date. Much less manual work ### 12. Extremely Flexible Dependency Update Manager **Rating:** 4.0/5.0 stars **Reviewed by:** Sam B. | Software Engineer, Small-Business (50 or fewer emp.) **Reviewed Date:** July 12, 2021 **What do you like best about Mend.io?** They had an option for nearly every configuration I wanted. **What do you dislike about Mend.io?** Renovate really taxes my build system credits since there are so many PRs. There's an option to group PRs, but then if they fail CI I have to figure out which dependency caused the failure manually. Ideally, it would group dependency updates but then do a binary search to find the update that broke the build (Similar to bors for regular PRs, but I can't use bors to solve dependency problems because automerge will always fail due to conflicts in lockfiles) **What problems is Mend.io solving and how is that benefiting you?** Trying to regularly update my dependencies to get ahead of security vulnerabilities and prevent dependency ossification. ### 13. Great Whitesource **Rating:** 4.5/5.0 stars **Reviewed by:** Bervianto Leo P. | Software Engineer, Computer Software, Small-Business (50 or fewer emp.) **Reviewed Date:** April 15, 2021 **What do you like best about Mend.io?** Security scanning features that allow me to detect the dependencies vulnerabilities. Github integration to detect the dependencies vulnerabilities. Detect each package and the solution for the vulnerabilities detection. It's great enough for me to help without browsing one by one the depencies. I can resolve the problem and also check the current vulnerabilities with easy way. It's great features for me. I think that features is really best as it is have free features. I know the free scanning have limitation but it's enough for me. **What do you dislike about Mend.io?** No one, it's good enough. I think no one needs to be dislike. All is good enough. **Recommendations to others considering Mend.io:** You should see this one. It's excellent software that will help with security solutions. **What problems is Mend.io solving and how is that benefiting you?** Security vulnerabilities scanner, easy to know and detect the security problem. It's feature really make me crazy, I know the dependencies vulnerabilies in a second. It's fast enough fore me. I can't realize if I need to check it one by one, it will take more time. Check one by one each package, each repositories, it will take much time if I do it manually. Thank you for whitesource that bring me the solution to check it use the whitesource-bolt for github which is give me to save my time and take more time for solving the packages dependencies instead of checking the package. So It's really great for me. This WhiteSource Software have possibilities to more growth since it will help all fellow developer or admin or security team to check each vulnerabilities. I can't say much. It's really great! ### 14. Whitesource **Rating:** 4.0/5.0 stars **Reviewed by:** Vivek Kumar S. | Software Engineer, Mid-Market (51-1000 emp.) **Reviewed Date:** February 21, 2022 **What do you like best about Mend.io?** Interface and flow of the application.Also the simplicity **What do you dislike about Mend.io?** Nothing specific thing that i would dislike **What problems is Mend.io solving and how is that benefiting you?** Business needs and mostly it's in trial phase so no enough data for now ### 15. It kept my dependencies up-to-date even when I forgot it! **Rating:** 5.0/5.0 stars **Reviewed by:** Rajdeep M. | Chief Executive Officer, Small-Business (50 or fewer emp.) **Reviewed Date:** October 04, 2021 **What do you like best about Mend.io?** The Pull Request for dependency updates is excellent! **What do you dislike about Mend.io?** The Renovate itself is great, but the only feature I disliked is it might be great if renovate gave us an option to configure a repo with the dashboard (which only shows logs) instead of using a file! **What problems is Mend.io solving and how is that benefiting you?** I've solved the issue of outdated-dependencies with Renovate! ### 16. Amazing! **Rating:** 5.0/5.0 stars **Reviewed by:** Vinícius Luiz d. | Software Engineer, Small-Business (50 or fewer emp.) **Reviewed Date:** November 05, 2021 **What do you like best about Mend.io?** It's amazing to have Renovate Bot working on my projects. It's really simple to setup and very useful! An essential tool for keeping things up-to-date and secure. **What do you dislike about Mend.io?** I don't see anything bad - I'm really enjoying all the experience using this tool. **What problems is Mend.io solving and how is that benefiting you?** It's very important to keep dependencies up-to-date in all projects to avoid security issues or things being outdated so this tool is amazing to solve this kind of thing automatically. ### 17. Fantastic dependency management **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Automotive | Small-Business (50 or fewer emp.) **Reviewed Date:** January 06, 2022 **What do you like best about Mend.io?** Automated and configurable dependency managed, it's very much a set and forget **What do you dislike about Mend.io?** Nothing so far, everything works great, only issues are with the actual git platforms **Recommendations to others considering Mend.io:** Great if you have to manage multiple dependencies across any sizeable projects **What problems is Mend.io solving and how is that benefiting you?** We host many client sites all managing the dependencies and keeping them up to date was a full time job, now we're able to automate the whole process ### 18. Works great, super simple to setup! **Rating:** 5.0/5.0 stars **Reviewed by:** Rage K. | Small-Business (50 or fewer emp.) **Reviewed Date:** January 11, 2021 **What do you like best about Mend.io?** The best part about WhiteSource Renovate is the power it gives my development teams. By reducing toil and increasing automation, WhiteSource Renovate has accelerated our development and business workflows. The variety of ways to leverage WhiteSource Renovate is truly compelling, the possibilities are endless. Given that many of these features and capabilities are available freely, there's really absolutely no downside in giving WhiteSource Renovate a try. Documentation is always the hardest, but WhiteSource has done a great job in providing easy onboarding. **What do you dislike about Mend.io?** Introducing WhiteSource Renovate to our development team took time for them to realize all the tasks they could automate. In some ways the documentation is complete, however some feedback I receives when working with the development team was to increase the number of examples. It would be helpful to provide additional links to sample workflows, and even some very complex ones that pull together regex, with package monitoring. **Recommendations to others considering Mend.io:** Read the Documentation, it's always the best resource **What problems is Mend.io solving and how is that benefiting you?** Dependency tracking, Helm chart monitoring, Docker image monitoring - before WhiteSource Renovate we had to manually watch for and commit changes for all dependencies used in our projects and update them manually. Once we implemented WhiteSource Renovate into our workflow, many of these challenges were simplified our fully eliminated. We are definitely looking into ways in how we can leverage WhiteSource Renovate further and where we can use it additionally in our developer workflows. Our developers are certainly excited to see what can be automated using WhiteSource Renovate. ### 19. Makes keeping up with updates 1000x easier! **Rating:** 5.0/5.0 stars **Reviewed by:** Alex V. | CTO, Small-Business (50 or fewer emp.) **Reviewed Date:** September 01, 2021 **What do you like best about Mend.io?** The customization and ability to self-host **What do you dislike about Mend.io?** A bit complicated to set up on Gitlab and occasional bugginess **What problems is Mend.io solving and how is that benefiting you?** Making sure all of our dependencies are up to date across all of our projects. ### 20. First steps with renovate and Terraform **Rating:** 4.0/5.0 stars **Reviewed by:** Sujith Q. | Azure Architect, Small-Business (50 or fewer emp.) **Reviewed Date:** August 05, 2021 **What do you like best about Mend.io?** It works with a bare minimum of configuration **What do you dislike about Mend.io?** It took me quite a while to find out what that bare minimum was although there is documentation available. **What problems is Mend.io solving and how is that benefiting you?** Find out when you run behind using certain versions of Terraform modules ### 21. Renovate Github Bot helps me to keep my repos up to date **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Computer Software | Small-Business (50 or fewer emp.) **Reviewed Date:** April 12, 2021 **What do you like best about Mend.io?** I think the best about the Whitesource Products are the Integration with for example Github. The Github Apps are easy to install and provide a great user experience. For exmple the renovate bot automatically informs you about package updates. When updating packages packages from a monorepo are considered. Also changelogs are displayed in pull request messages from the renovate bot. **What do you dislike about Mend.io?** I think there is nothing to dislike about the whitesource products. **Recommendations to others considering Mend.io:** Use it. It meets all requirements. **What problems is Mend.io solving and how is that benefiting you?** They realy help keeping dependencies up-to-date and help with vulnerabilities in depended on packages. ### 22. Invaluable tool to keep your software safe **Rating:** 4.0/5.0 stars **Reviewed by:** Christian D. | Senior Java Analyst Programmer, Small-Business (50 or fewer emp.) **Reviewed Date:** September 02, 2020 **What do you like best about Mend.io?** Summary: Whitesource shows us which libraries can be upgraded and which ones are vulnerable. This keeps our code up-to-date with other project's releases. Having an integration into our pipeline assures us we can follow this up easily. Applying Whitesource to our projects has helped us tremendously in keeping our project secure. It would be more difficult for our developers to search around to try and find those vulnerabilities by themselves. Most projects do have hundreds of third-party libraries, and even more are downloaded transitively. By comparing the used libraries with known and reported vulnerabilities, we have everything we need in one place. Each new branch with updated code, triggers a Whitesource build in our pipeline. The email reports are nice triggers for our developers to start looking into vulnerabilities and library updates. Whitesource gives useful resolution suggestions, such as how to avoid the vulnerabilities or which library version no longer has the issue. Another useful feature is the check on licences. Most developers do not bother looking into which libraries are included in their projects. Whitesource gives a comprehensive list and overview of all licences used in a project. This allows early detection of any non-free library and gives the opportunity to find alternatives quickly. **What do you dislike about Mend.io?** For each new branch we add to the project, a new product section is created. When our branches are then merged into the master branch, those products remain. Each email report will also include and compare them to the other branches, making the report less useful. This has triggered us to regularly and manually delete those product sections, and only keep the latest reports and branches. **Recommendations to others considering Mend.io:** Anyone should have some tool such as WhiteSource to keep their software safe. **What problems is Mend.io solving and how is that benefiting you?** Our security operations has never been happier with our results. We were also able to quickly detect a non-free license that was used, so we could avoid legal issues when our software was put into production. ### 23. Powerful tool to manage external libraries **Rating:** 5.0/5.0 stars **Reviewed by:** Martin H. | Small-Business (50 or fewer emp.) **Reviewed Date:** January 04, 2021 **What do you like best about Mend.io?** Renovate is easy to setup and works with all VCS you can think of (also self-hosted). I was impressed by the amount of configuration that exists and it saves me quite some time keeping dependencies up-to-date. Documentation is also really good. **What do you dislike about Mend.io?** Although the first run was easy, configuring details was a bit of trial and error at first. I was unsure about what a global and what a project specific setting is. **What problems is Mend.io solving and how is that benefiting you?** Keeping dependencies up-to-date and therefore fixing security problems. ### 24. Perfect product **Rating:** 4.5/5.0 stars **Reviewed by:** Verified User in Computer Software | Mid-Market (51-1000 emp.) **Reviewed Date:** November 10, 2020 **What do you like best about Mend.io?** The application gives you a really good overview of all the outdated dependencies, an overview of all the licenses used in all the dependencies, all the vulnerabilities coming out of the used dependencies, policy violations, and much more. **What do you dislike about Mend.io?** The UI could be updated but for the EE it's suitable. **Recommendations to others considering Mend.io:** The WhiteSource gives you really a good overview of outdated dependencies, vulnerability with good suggestions on what to do to solve them. With the integration with a GitHub, you can get a really good view of where the issues are coming and how to solve them, as you will get an alert already in the PR request. **What problems is Mend.io solving and how is that benefiting you?** We solve the major problem of compliance as now we have an overview of the licenses used in all our products and we can view all of this in one single application on one single page. ### 25. Works like a charm **Rating:** 4.0/5.0 stars **Reviewed by:** Verified User in Program Development | Small-Business (50 or fewer emp.) **Reviewed Date:** February 18, 2021 **What do you like best about Mend.io?** Out of the box it's already helping a lot. When you dive into the configurations there's even more awesome things you can achieve. **What do you dislike about Mend.io?** I didn't like the constant stream of emails from Github pull requests. Something you can easily manage with the right config settings. **What problems is Mend.io solving and how is that benefiting you?** I want to keep my JAMstack codebase up to date ### 26. Great products, Renovate is a perfect fit for our open-source! **Rating:** 4.5/5.0 stars **Reviewed by:** Dotan S. | Chief Technology Officer, Small-Business (50 or fewer emp.) **Reviewed Date:** December 24, 2020 **What do you like best about Mend.io?** - Monorepo support - Super fast responses - Rebasing works great **What do you dislike about Mend.io?** - Adding it to an existing project might bloat the repo at first. - Missing the ability to group all changes based on commits, in a single PR. (this way CI runs for each change, and you can get a daily overview) **Recommendations to others considering Mend.io:** Use it! **What problems is Mend.io solving and how is that benefiting you?** Renovate helps us to keep everything updated and make sure our app is compatible with all libraries changes. ### 27. Whitesource Renovate was easy to set up, and very configurable **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Computer Software | Mid-Market (51-1000 emp.) **Reviewed Date:** January 18, 2021 **What do you like best about Mend.io?** The configurability is great. I have tried other tools which only supported a tiny subset of certain programming languages and their package managers. Whitesource Renovate can be configured to update version for pretty much anything, as long as you can find a consistent place that lists versions, such as github releases, and you can regex yourself to the current version you are using. This helped us set up version upgrades for Helm charts stored in ArgoCD Application files. **What do you dislike about Mend.io?** It can be a bit unclear why a file isn't picked up and considered for version upgrades. If you have set up a regex, and no files match looks exactly the same as if files match but the contents doesn't. **What problems is Mend.io solving and how is that benefiting you?** Whitesource Renovate allows us to update just about any version we have defined in source control. ### 28. Positive experience while rolling out WhiteSource **Rating:** 4.0/5.0 stars **Reviewed by:** Verified User in Computer Software | Enterprise (> 1000 emp.) **Reviewed Date:** September 04, 2020 **What do you like best about Mend.io?** WhiteSource has been very active helping us to get started and get the most out of the tool, this also helps resolves the "dislikes" to a great extent. WhiteSource has also been very willing to help out investigate incorrect attribution. Single Sign-on makes makes it easy to switch to the portal. The home-view is a good dashboard with an overview of the organization, product, or project status. There are many integration options, such as Jira, GitHub, Travis CI, Jenkins, TeamCity, Bamboo, Azure DevOps, Circle CI, AWS CodeBuild, Google Cloud Build, etc. **What do you dislike about Mend.io?** The "Policies" are quite limited in their current form and only a single policy can trigger. This means a policy at the product level can prevent organization wide policy violations to trigger. This can be useful when making exceptions as the product level, but this also means a product level admin can overrule organization wide decisions. The products - projects model takes quite a bit of insight and help to be used effectively. **Recommendations to others considering Mend.io:** Ask WhiteSource for a presentation, and possibly demo, on their capabilities and then request to start a trial. Let them help you try out the tool with one of your own projects. **What problems is Mend.io solving and how is that benefiting you?** WhiteSource helps getting an overview of all open source software in use. It provides information about vulnerabilities and their possible implications. WhiteSource also provides license information that helps us ensure we comply with all license requirements and we do not use libraries that are only available under unacceptable licenses. ### 29. Great way to keep up your app updated **Rating:** 3.5/5.0 stars **Reviewed by:** Verified User in Education Management | Small-Business (50 or fewer emp.) **Reviewed Date:** April 23, 2021 **What do you like best about Mend.io?** Automation of the process, auto merging pull requests, the information provided inside. **What do you dislike about Mend.io?** I haven't found the pin dependencies feature useful, but maybe I need to dig more to fully benefit from it. **Recommendations to others considering Mend.io:** I would highly reccomend **What problems is Mend.io solving and how is that benefiting you?** Keeping all app dependencies up to date, without human work. ### 30. Impressive tool to understand your Code... **Rating:** 4.5/5.0 stars **Reviewed by:** Ricardo R. | Chief Information Technology Officer, Small-Business (50 or fewer emp.) **Reviewed Date:** April 05, 2021 **What do you like best about Mend.io?** Ability to explore code dependencies and get a better insight of the real extent or external component usage. **What do you dislike about Mend.io?** Can't really think of many flaws I would address on the software... **What problems is Mend.io solving and how is that benefiting you?** Licensing scope can be critical if not addressed timely, we can pipoint potential issues before they arise as a major problem. ### 31. Renovate is a must-have **Rating:** 5.0/5.0 stars **Reviewed by:** Jérémie M. | Director of Engineering, Enterprise (> 1000 emp.) **Reviewed Date:** October 01, 2020 **What do you like best about Mend.io?** Renovate is a time saver, more specifically, saving precious engineering time and brings peace of mind as we automated our application dependencies updating. **What do you dislike about Mend.io?** Nothing really. The Renovate tool is part of the toolchain for every applications. And is now free! **What problems is Mend.io solving and how is that benefiting you?** Automate everything! Instead of a manual process to update our dependencies and relying on a benevolent engineer to keep track of the necessary updates, Renovate does it automatically and with a lot of different configuration options. We are now confident that our application is not falling behind. By automating dependency management updates, we can reallocate engineers hours to more value adding projects. ### 32. Better solutions in the market **Rating:** 0.0/5.0 stars **Reviewed by:** Verified User in Telecommunications | Mid-Market (51-1000 emp.) **Reviewed Date:** March 22, 2021 **What do you like best about Mend.io?** There's a lot of work involved in setting it up, but it works for the most part, except it doesn't cover dependencies of dependencies, which may be a requirement that you need to cover. The interface is clunky and outdated. There are new players emerging players in the market that are playing catch-up (e.g. FOSSA) **What do you dislike about Mend.io?** I'm not a fan of the sales team and their tactics -- very high pressure. I would be very careful in approaching any conversations with these folks. **Recommendations to others considering Mend.io:** Look at other solutions. **What problems is Mend.io solving and how is that benefiting you?** Evaluating risks associated with FOSS. ### 33. Update all your dependencies **Rating:** 4.5/5.0 stars **Reviewed by:** Verified User in Computer Software | Small-Business (50 or fewer emp.) **Reviewed Date:** January 28, 2021 **What do you like best about Mend.io?** Pin to specific versions of a dependency **What do you dislike about Mend.io?** The first run seems to be a bit slow when you are waiting for it to finish on multiple repos **What problems is Mend.io solving and how is that benefiting you?** I wanted to update my dependencies on more than just one file in the repo. This tool does that. ### 34. Fills gap for monorepos **Rating:** 4.5/5.0 stars **Reviewed by:** Verified User in Financial Services | Small-Business (50 or fewer emp.) **Reviewed Date:** March 11, 2021 **What do you like best about Mend.io?** Extensive configuration options for maximum flexibility. Support for an impressive number of package management tools. **What do you dislike about Mend.io?** Documentation around configuration options is difficult to navigate and understand. All advanced features and basic features are together with no separation. I think many people would benefit from several examples that demonstrate common configurations that renovate is used in. **What problems is Mend.io solving and how is that benefiting you?** Multi-language dependency update in a monorepo, using renovate ### 35. Renovate is awesome! **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Music | Small-Business (50 or fewer emp.) **Reviewed Date:** November 23, 2020 **What do you like best about Mend.io?** My favorite thing about Renovate is the customizability. You can adjust everything about how Renovate works down to the most minute detail. **What do you dislike about Mend.io?** One downside of Renovate is that the customizability can be overwhelming. Fortunately, their config-help repository is very good at offering advice and helping you figure out how to accomplish what you want. **What problems is Mend.io solving and how is that benefiting you?** Renovate helps me automatically update dependencies in my JavaScript projects. It keeps me from needing to remember to check every few days. ### 36. WhiteSource makes everything easier! **Rating:** 4.0/5.0 stars **Reviewed by:** Verified User in Computer Software | Small-Business (50 or fewer emp.) **Reviewed Date:** October 20, 2020 **What do you like best about Mend.io?** I love how it makes easy it is to manage my openSource web components. I never have to worry about missing an important notification if something goes wrong! **What do you dislike about Mend.io?** There isn't much to dislike with whiteSource! Maybe one thing I'd suggest is to make it a little less expensive. But honestly, it's already worth the price! **What problems is Mend.io solving and how is that benefiting you?** We use it to monitor our various UI libraries along with other smaller repositories that are vital to our company. It was very easy to setup and get started with almost instant monitoring. ### 37. Powerful tool, very configurable, decent support **Rating:** 4.5/5.0 stars **Reviewed by:** Verified User in Transportation/Trucking/Railroad | Enterprise (> 1000 emp.) **Reviewed Date:** January 07, 2021 **What do you like best about Mend.io?** RenovateBot, whether for Bitbucket, GitHub, or Azure Repos, is a comprehensive and powerful tool. Their support on GitHub is responsive to questions and PRs. (They’re all about delivering rapid updates of dependencies; so it’s no surprise that they have rapid and regular releases.) With a reasonable amount of initial effort, it’s pretty easy to set up with your repositories/automation tool. **What do you dislike about Mend.io?** It takes a little bit to understand the configuration. **What problems is Mend.io solving and how is that benefiting you?** Automated PRs regarding dependencies, ability to throttle the pace and volume of the PRs. ### 38. Indispensable **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Retail | Enterprise (> 1000 emp.) **Reviewed Date:** August 27, 2020 **What do you like best about Mend.io?** Turns keeping your software up to date from a chore into something you don’t even need to think about. **What do you dislike about Mend.io?** Faster creation of MRs - perhaps a database of who uses what dependency so as soon as a new release is created they can all be updated, rather than each repo polling their dependencies individually. **Recommendations to others considering Mend.io:** Focus on building a good test suite so you can turn on auto merging. Also an automatic semantic release pipeline makes things even smoother. **What problems is Mend.io solving and how is that benefiting you?** Keeping a large number of repos up to date with internal and external dependency changes. It had made it much easier for us to split our own libraries up into smaller pieces. ### 39. WhiteSource and Github **Rating:** 4.5/5.0 stars **Reviewed by:** Habil B. | Small-Business (50 or fewer emp.) **Reviewed Date:** November 05, 2020 **What do you like best about Mend.io?** I like Easy configuration and accurate results **What do you dislike about Mend.io?** Everything is perfect, I have nothing to complain about. **What problems is Mend.io solving and how is that benefiting you?** When I develop an application I constantly checking dependency versions. Thanks to WhiteSource is automated now. ### 40. Pleasant to use, highly-configurable yet powerful out of the box **Rating:** 4.0/5.0 stars **Reviewed by:** Charalampos F. | President, Small-Business (50 or fewer emp.) **Reviewed Date:** December 31, 2020 **What do you like best about Mend.io?** Configuration as code, easy out of the box setup, all aspects are customizable **What do you dislike about Mend.io?** The lack of a useful web dashboard to make first-time configuration a bit easier **What problems is Mend.io solving and how is that benefiting you?** We're using WhiteSource's software to update dependencies for our Rust projects ### 41. Great Bot **Rating:** 5.0/5.0 stars **Reviewed by:** Marek N. | Demo Solution Senior Specialist , Small-Business (50 or fewer emp.) **Reviewed Date:** January 25, 2021 **What do you like best about Mend.io?** I like Renovate works with GitHub and is free **What do you dislike about Mend.io?** There is nothing to dislike, works as expected **What problems is Mend.io solving and how is that benefiting you?** Upgrading image versions to newest version ### 42. White Source Bolt Review (open source packages scanner) **Rating:** 3.5/5.0 stars **Reviewed by:** Elyes C. | Application Security Engineer, Mid-Market (51-1000 emp.) **Reviewed Date:** September 02, 2020 **What do you like best about Mend.io?** the easy way to implement in the cloud into our pipelines **What do you dislike about Mend.io?** at the moment i didn't noticed anything that i can dislike **Recommendations to others considering Mend.io:** i recommend whitesource to scan opensource code **What problems is Mend.io solving and how is that benefiting you?** the problems that everyone are facing, we all use opensource packages but without scanning them for known vulnerabilities, whitesource bolt is a great scanner for that purpose ### 43. Very happy with Renovate **Rating:** 4.5/5.0 stars **Reviewed by:** Verified User in Information Technology and Services | Small-Business (50 or fewer emp.) **Reviewed Date:** January 28, 2021 **What do you like best about Mend.io?** Renovate has been great at helping us keep up to date with our dependencies. **What do you dislike about Mend.io?** Limitations in functionality around customer plugins. **What problems is Mend.io solving and how is that benefiting you?** I'd like to be able to extend the default file format types that renovate checks. In some gradle plugins, versions are written in files such as `versions.props`. Renovate doesn't allow flexibility in this regard. ### 44. Phenomenal Work **Rating:** 4.5/5.0 stars **Reviewed by:** Verified User in Leisure, Travel & Tourism | Small-Business (50 or fewer emp.) **Reviewed Date:** November 19, 2020 **What do you like best about Mend.io?** The way their services work effortlessly. They have justified their product without making any excuses while making it reliable and sustainable. **What do you dislike about Mend.io?** They are lacking activeness in other many sectors where this technology is appreciated. **What problems is Mend.io solving and how is that benefiting you?** I have to get in touch with renovate bot and it does all the stuff for me like worrying about updating requirements.txt and package.json deps. I like how it could be configured with a JSON file and you rest easy while it does work for you. ### 45. A real timesaver **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Automotive | Small-Business (50 or fewer emp.) **Reviewed Date:** February 04, 2021 **What do you like best about Mend.io?** Peace of mind with automation and inherited security **What do you dislike about Mend.io?** Removal of Gitlab support, but looks like they are working on it. **What problems is Mend.io solving and how is that benefiting you?** Automated dependency updates, alerts for security issues. ### 46. Tool has unique options and easy to configure. **Rating:** 4.5/5.0 stars **Reviewed by:** sudheer c. | Enterprise (> 1000 emp.) **Reviewed Date:** August 28, 2020 **What do you like best about Mend.io?** Using Whitesource tool it is easy to identify and Manage the open source components used in our applications. **What do you dislike about Mend.io?** for most of the WS features documentation is incomplete. **Recommendations to others considering Mend.io:** One of the best FOSS tool available in the market. **What problems is Mend.io solving and how is that benefiting you?** we are able to identify the vulnerable and outdated open source components early in the phase of development which saves development team time to fix the issues in pre prod. ### 47. More Code Less Worry **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Non-Profit Organization Management | Small-Business (50 or fewer emp.) **Reviewed Date:** January 08, 2021 **What do you like best about Mend.io?** Easily keep my packages updated on my project. **What do you dislike about Mend.io?** Merge conflicts happen. Renovate handles rebasing well, but it's still tedious to manage those. **What problems is Mend.io solving and how is that benefiting you?** Using Renovate to keep my project up to date. ### 48. Easy interface - Max productivity **Rating:** 4.0/5.0 stars **Reviewed by:** Gagandeep R. | Small-Business (50 or fewer emp.) **Reviewed Date:** October 08, 2020 **What do you like best about Mend.io?** Easy setup, smooth user experience and friendly user interface **What do you dislike about Mend.io?** Not robust adaptation to certain website source codes. **What problems is Mend.io solving and how is that benefiting you?** Go-to solution but work needs to be done to refine automation. ### 49. Automating software IPR checking **Rating:** 4.0/5.0 stars **Reviewed by:** Verified User in Computer & Network Security | Mid-Market (51-1000 emp.) **Reviewed Date:** June 19, 2020 **What do you like best about Mend.io?** The offering is delivered as SaaS and has an intuitive and easy to use interface which provides rapid access to key information on IPR and security vulnerabilities in an easy to understand graphical format. the wide range of reporting options allow potential issues to be captured and explored in more detail. **What do you dislike about Mend.io?** Configuration of the scanning element of the offering requires some practice and there are a large number of parameters to master. **What problems is Mend.io solving and how is that benefiting you?** We have transitioned from a manual process of IPR audit to a fully automated and integrated one which saves considerable time and allows experts to concentrate in areas the specifically require human intervention. This greatly reduces the exposure to to potential IPR liability issues for the organisation. ### 50. WhiteSource identifies security vulnerabilities in easy steps & provides remediation for quick fixes **Rating:** 5.0/5.0 stars **Reviewed by:** Sheetal P. | Enterprise (> 1000 emp.) **Reviewed Date:** June 17, 2020 **What do you like best about Mend.io?** User friendly, quick remediation & better reports **What do you dislike about Mend.io?** Provides only OSS security vulnerabilities **Recommendations to others considering Mend.io:** WhiteSource is best in class solution, easy to adapt and with good customer support. **What problems is Mend.io solving and how is that benefiting you?** Outdated versions of Open source libraries, vulnerable library components ## Mend.io Discussions - [Does the above pricing include all vulnerabilities sources?](https://www.g2.com/discussions/do-you-offer-an-on-premise-option) - 1 comment, 1 upvote - [What languages and platforms does your solution support?](https://www.g2.com/discussions/is-my-code-secure-with-your-cloud-based-service) - 1 comment, 1 upvote - [Why are you pricing per contributing developers?](https://www.g2.com/discussions/i-can-t-find-a-plugin-for-my-build-tool-server-does-that-mean-you-cannot-support) - 1 comment, 1 upvote - [Do you offer an on-premise option?](https://www.g2.com/discussions/does-whitesource-work-with-all-languages-and-build-tools) - 1 comment, 1 upvote - [What is a contributing developer?](https://www.g2.com/discussions/3104-how-does-whitesource-work) - 1 comment, 1 upvote - [View Mend.io pricing details and edition comparison](https://www.g2.com/products/mend-io/reviews?page=2§ion=pricing&secure%5Bexpires_at%5D=2026-08-02+09%3A33%3A29+-0500&secure%5Bsession_id%5D=22dd8f89-1169-4d35-bba4-13019c602c24&secure%5Btoken%5D=0f51fedecb5df8364d4b435d8bfee11a9b92f88620c58c083e4704e74f95d426&format=llm_user) ## Mend.io Integrations - [Axonius](https://www.g2.com/products/axonius/reviews) - [Bitbucket](https://www.g2.com/products/bitbucket/reviews) - [GitHub](https://www.g2.com/products/github/reviews) - [Jenkins](https://www.g2.com/products/jenkins/reviews) - [TeamCity](https://www.g2.com/products/teamcity/reviews) ## Mend.io Features **Administration** - API / Integrations - Extensibility **Administration** - Risk Scoring - Security Auditing - Configuration Management **Performance** - Issue Tracking - Detection Rate - False Positives - Automated Scans **Functionality - Software Composition Analysis ** - Language Support - Integration - Transparency **Security** - Malicious Code - Security Risks **Risk management - Application Security Posture Management (ASPM)** - Vulnerability Management - Risk Assessment and Prioritization - Compliance Management - Policy Enforcement **Functionality - Software Bill of Materials (SBOM)** - Format Support - Annotations - Attestation **Agentic AI - Static Code Analysis** - Adaptive Learning - Natural Language Interaction - Proactive Assistance **Analysis** - Reporting and Analytics - Issue Tracking - Static Code Analysis - Code Analysis **Network** - Compliance Testing - Configuration Monitoring **Effectiveness - Software Composition Analysis** - Remediation Suggestions - Continuous Monitoring - Thorough Detection **Tracking** - Bill of Materials - Audit Trails - Monitoring **Integration and efficiency - Application Security Posture Management (ASPM)** - Integration with Development Tools - Automation and Efficiency **Management - Software Bill of Materials (SBOM)** - Monitoring - Dashboards - User Provisioning **Security** - Security Auditing **Testing** - Command-Line Tools - Test Automation - Compliance Testing - Black-Box Scanning - Detection Rate - False Positives **Protection** - Dynamic Image Scanning **Application** - Static Code Analysis - Black Box Testing **Reporting and Analytics - Application Security Posture Management (ASPM)** - Trend Analysis - Risk Scoring - Customizable Dashboards **Policy Enforcement and Compliance - AI Security Solutions** - Scalable Governance - Shadow AI - Policy‑as‑Code for AI Assets **Identity** - SSO - Governance - User Analytics **Agentic AI - Vulnerability Scanner** - Autonomous Task Execution - Proactive Assistance **Agentic AI - Static Application Security Testing (SAST)** - Autonomous Task Execution **Agentic AI - Application Security Posture Management (ASPM)** - Autonomous Task Execution - Multi-step Planning ## Top Mend.io Alternatives - [Snyk](https://www.g2.com/products/snyk/reviews) - 4.5/5.0 (135 reviews) - [Veracode Application Security Platform](https://www.g2.com/products/veracode-application-security-platform/reviews) - 3.8/5.0 (25 reviews) - [SonarQube](https://www.g2.com/products/sonarqube/reviews) - 4.4/5.0 (153 reviews)