Depna

Dependency Scanner Without Code Access

Depna provides a secure, fast, and compliant way to scan for dependency vulnerabilities without ever touching your source code or requiring repository permissions. By focusing on file-based scanning, Depna allows teams to maintain strict security boundaries while ensuring their software supply chain is protected.

Why Choose Depna?

Most scanners require complex setups and deep repository access. Depna simplifies the process by allowing you to upload a manifest or lockfile and get results in under 2 minutes.

• Zero Code or Repo Access: No OAuth, no Git app installs, no source-code permissions required.
• Platform Independent: Works with GitHub, GitLab, Bitbucket, and self-hosted systems.
• Audit-Ready Reports: Generate PDFs aligned with ISO 27001 and SOC 2 Type II controls.
• Continuous Monitoring: Your uploaded files are re-scanned every 2 hours against the latest CVE databases.
• AI-Powered Insights: Get technical details, business impacts, and executive summaries for every vulnerability.

How It Works

1. Upload a dependency file: Create an account and upload a manifest (e.g., package-lock.json, requirements.txt) or lockfile from any of the 9 supported ecosystems.
2. Run a no-code-access scan: Depna analyzes every dependency against updated vulnerability intelligence without needing repository access.
3. Instant Alerts: Receive critical and high-severity notifications via Slack, Teams, Discord, or Email immediately upon detection.
4. AI Reports & Summaries: Access weekly and monthly AI-powered summaries with executive-ready insights for non-technical stakeholders.
5. Audit-Ready PDFs: Download white-labeled (on Enterprise) audit reports to prove your security posture to auditors.

Supported Ecosystems

Depna supports dependency files from the following ecosystems:

• JavaScript: package-lock.json, yarn.lock, pnpm-lock.yaml
• Python: requirements.txt, poetry.lock
• Java: pom.xml
• PHP: composer.lock
• Go: go.mod
• .NET: packages.lock.json
• Ruby: Gemfile.lock
• Rust: Cargo.lock
• Hex: mix.lock

Resolution Workflow

Depna doesn't just list vulnerabilities; it helps you manage the resolution lifecycle:

• Auto-Fixed: Automatically identifies when you are already on a safe version.
• Accepted Risk: Set future re-evaluation dates and receive reminders.
• **False Positive:** Flag incorrect matches with notes for your records.
• Manual Fixed: Log mitigations with responsible owners and target remediation dates.