Dependency-Track is an OWASP flagship project: an intelligent Component Analysis platform that inventories the components inside your software and tells you which of them carry risk. Instead of scanning source trees one repository at a time, it works from the Software Bill of Materials (SBOM) — CycloneDX documents produced by your build pipeline or supplied by a vendor — and tracks every component in every version of every project in a portfolio. That portfolio-wide view is what separates it from traditional Software Composition Analysis tools, which can only see the one project they are pointed at.

The platform is API-first, runs as a self-hosted server with a browser dashboard, and is designed to sit inside CI/CD: SBOMs are published to it over the REST API or a CI plugin, components are continuously matched against live vulnerability intelligence, and findings flow back out through webhooks, chat-ops and email. Dependency-Track is used in production by more than 20,000 organisations and is maintained by the OWASP Foundation.

Key Features

• CycloneDX SBOM ingestion and production — Consumes and produces CycloneDX SBOMs and CycloneDX VEX (Vulnerability Exploitability Exchange) documents.
• Full-stack component inventory — Tracks applications, libraries, frameworks, operating systems, containers, firmware, files, hardware and services across every version of every project.
• Multiple vulnerability intelligence sources — Matches components against the NVD, GitHub Advisories, Sonatype OSS Index, Snyk, Trivy, OSV and VulnDB, plus a private vulnerability database you maintain yourself.
• EPSS-based prioritisation — Incorporates the Exploit Prediction Scoring System so teams can rank findings by the likelihood of exploitation, not just severity.
• Policy engine — Global and per-project policies for security, licence and operational risk, able to fail a build when a policy is violated.
• Licence tracking — Standardised SPDX licence IDs with licence use tracked per component, so licence risk is measured alongside security risk.
• Auditing workflow — A structured triage workflow for analysing findings, with analyser attribution and audit history.
• Broad notification support — Slack, Microsoft Teams, Mattermost, Webex, email, Jira and generic webhooks.
• Ecosystem agnostic — Built-in repository support for Maven, NPM, PyPI, NuGet, Cargo, Composer, Gems, Hex and CPAN.
• Enterprise authentication — OAuth 2.0 / OpenID Connect single sign-on, Active Directory / LDAP and API keys.
• Integrations — Native support for DefectDojo, Fortify SSC, ThreadFix and Kenna Security, with OpenAPI-described endpoints for everything else.

Why Use Dependency-Track?

Most vulnerability scanners answer “what is wrong with this repository right now”. Dependency-Track answers “what is wrong with everything we ship, and what changed since yesterday” — because it keeps the SBOM as the inventory and re-analyses it continuously as new advisories land. A component that was clean at release time is flagged the moment a CVE is published against it, without rebuilding or rescanning anything. Its service and API component support also covers data flows, endpoint URIs and trust boundaries, which is where supply-chain questions usually start. Being free, self-hosted and Apache-2.0 licensed, it can hold the whole portfolio without per-seat or per-scan costs.

Use Cases

• CI/CD security gate — Publish an SBOM on every build and fail the pipeline when a policy threshold is breached.
• Supply-chain risk management — Track third-party libraries, base images and firmware across a whole organisation from one dashboard.
• Regulatory and customer assurance — Produce and retain SBOM evidence for software consumers, procurement questionnaires and audit.
• Licence compliance — Report on which SPDX licences are present in which products, per component.
• Incident response — When a widely used library is compromised, identify every affected project and version in minutes.

Deployment

Dependency-Track is a server application with a browser-based single-page frontend. It ships as an executable WAR (the API server, with an embedded Jetty), a separately deployable frontend SPA, a bundled WAR combining both, and official Docker images (dependencytrack/apiserver, dependencytrack/frontend, dependencytrack/bundled). A PostgreSQL database is required, and Helm charts are available for Kubernetes deployments. The upstream Docker quickstart runs the bundled image with 8 GB of RAM on port 8080. A Docker Compose file and manual deployment instructions are published on the project site.

Licence

Open source. Dependency-Track is released under the Apache License 2.0, copyright the OWASP Foundation. It is free to use, modify and redistribute, including in commercial and closed-source settings, subject to the terms of the Apache 2.0 licence.