DepWarden is a free, anonymous software composition analysis (SCA) and static application security testing (SAST) platform that runs in the browser with no account.
SCA: scans manifests, lockfiles, SBOMs and JARs across 11 ecosystems (npm, PyPI, Maven, Gradle, Go, Cargo, Composer, RubyGems, NuGet, Dart, Swift) against live OSV, CISA KEV and EPSS data. It also flags typosquatting, maintainer changes, install scripts and abandoned packages.
SAST: pattern and taint analysis across 14 languages with 300+ rules, plus secret scanning and IaC checks for Dockerfiles, Terraform, GitHub Actions and Kubernetes.
Findings are ranked by real-world exploitability (KEV, EPSS, fix availability) with compatibility-aware upgrade guidance. Export CycloneDX SBOMs with VEX; the CLI, Maven plugin and CI integrations can gate builds. Sessions are isolated and purged after 30 days.
