# DevGuard Documentation

> DevGuard is an open source application security platform integrating vulnerability scanning, SBOM management, and supply chain security for DevOps teams.

Every link below points to the Markdown source of a documentation page. Replace the `.md`
suffix with nothing to get the regular HTML page, e.g. `/getting-started/first-scan.md` is
rendered at `/getting-started/first-scan`.

## Overview

- [DevGuard Documentation](https://docs.devguard.org/index.md): DevGuard is an open source application security platform integrating vulnerability scanning, SBOM management, and supply chain security for DevOps teams.
- [DevGuard FAQ – Frequently Asked Questions](https://docs.devguard.org/faq.md): Answers to frequently asked questions about DevGuard, including troubleshooting scan errors, configuring repository visibility, and more.
- [DevGuard Documentation Glossary](https://docs.devguard.org/glossary.md): Definitions for the security and compliance terms and abbreviations used throughout the DevGuard documentation, from CVE to VEX and beyond.

## Getting Started

- [Setup a Fresh DevGuard Instance and Scan for Vulnerabilities](https://docs.devguard.org/getting-started/index.md): Get started with the DevGuard quick start guide and run your first security scan in minutes — open-source platform for vulnerability and SBOM management.
- [DevGuard for Compliance Officers - Software Compliance Management](https://docs.devguard.org/getting-started/choose-your-path/for-compliance-officers.md): How DevGuard helps compliance officers prove and maintain software compliance across every project — covering CRA, NIS2, PCI DSS, and ISO 27001 with.
- [DevGuard for DevOps Guide](https://docs.devguard.org/getting-started/choose-your-path/for-devops.md): How DevOps teams use DevGuard to secure the software delivery lifecycle — CI/CD scanning, container image signing, attestation-based deployment policies.
- [DevGuard for Security Teams](https://docs.devguard.org/getting-started/choose-your-path/for-security-teams.md): How security teams use DevGuard to gain organization-wide vulnerability visibility, enforce policies, and communicate risk across all software projects.
- [Your First Vulnerability Scan](https://docs.devguard.org/getting-started/first-scan.md): Run your first dependency scan with DevGuard — a step-by-step guide to setting up the scanner, executing your first SCA scan, and interpreting the results.
- [DevGuard Installation Guide](https://docs.devguard.org/getting-started/installation.md): How to install DevGuard scanner and the platform — setting up the CLI, configuring your environment, and connecting to your self-hosted DevGuard instance.
- [DevGuards Key Concepts in 2 Minutes](https://docs.devguard.org/getting-started/key-concepts.md): Learn the core DevSecOps shift-left security concepts behind DevGuard — SBOM, VEX, vulnerability management, and how they automate security in your pipeline.
- [Use DevGuard API with Personal Access Tokens](https://docs.devguard.org/getting-started/use-devguard-api.md): Use the DevGuard API with personal access tokens — asymmetric ECDSA signing tokens and symmetric Bearer tokens — including scopes, expiry, and revocation.

## Tutorials

- [Discovering Base Image Attestations](https://docs.devguard.org/tutorials/advanced/discover-base-image-attestations.md): Automatically discover and extract attestations from container base images to inherit security metadata and verify provenance in your DevGuard workflow.
- [DevGuard Audit Trails](https://docs.devguard.org/tutorials/compliance/audit-trails.md): Track and review all security events and actions in DevGuard's immutable audit trail — generating compliance reports and evidence for regulatory requirements.
- [Container Hardening Guide](https://docs.devguard.org/tutorials/container-hardening/index.md): Step-by-step guide for hardening container images using DevGuard scanning and vulnerability management — covering triage, CVE decisions, and compliance.
- [Container Hardening Checklist](https://docs.devguard.org/tutorials/container-hardening/container-hardening-checklist.md): Comprehensive checklist for hardening container images across the entire lifecycle from base image selection to runtime monitoring
- [Container Hardening CVE Decision Guide](https://docs.devguard.org/tutorials/container-hardening/cve-decision.md): Process for handling and deciding on CVE findings discovered in container images — triage, risk assessment, remediation, and VEX documentation with DevGuard.
- [Container Hardening Examples](https://docs.devguard.org/tutorials/container-hardening/examples.md): Example container hardening projects and templates to get started with container security using DevGuard scanning, VEX workflows, and CVE decision tracking.
- [Container Hardening Process](https://docs.devguard.org/tutorials/container-hardening/process.md): Structured process for systematically hardening container images with automated DevGuard scanning, vulnerability triage, and compliance verification steps.

## How-to Guides

- [DevGuard How-To Guides and Tutorials](https://docs.devguard.org/how-to-guides/index.md): Practical step-by-step DevGuard how-to guides for scanning, compliance, administration, integrations, and vulnerability management workflows.
- [DevGuard Administration Guides Overview](https://docs.devguard.org/how-to-guides/administration/index.md): DevGuard administration guides covering deployment, configuration, backup, upgrades, monitoring, and user management for self-hosted DevGuard installations.
- [DevGuard Backup & Restore](https://docs.devguard.org/how-to-guides/administration/backup-restore.md): Complete DevGuard backup restore guide — database dumps, configuration backup, and disaster recovery procedures for self-hosted deployments.
- [DevGuard Customize the UI](https://docs.devguard.org/how-to-guides/administration/customize-ui.md): How to customize DevGuard UI with custom CSS, JavaScript, and configure legal notices and contact information for your organization.
- [DevGuard Database Maintenance Guide](https://docs.devguard.org/how-to-guides/administration/database-maintenance.md): DevGuard database maintenance — automated vulnerability database updates, manual refresh procedures, and troubleshooting database issues for administrators.
- [Deploy DevGuard with Docker Compose](https://docs.devguard.org/how-to-guides/administration/deploy-with-docker.md): How to deploy DevGuard with Docker Compose for testing, evaluation, or production — configuration, environment variables, and getting started.
- [Deploy DevGuard with Helm on Kubernetes](https://docs.devguard.org/how-to-guides/administration/deploy-with-helm.md): How to deploy DevGuard Helm Kubernetes chart — values configuration, ingress setup, persistent storage, and production deployment best practices.
- [Set Up the Instance Admin Dashboard](https://docs.devguard.org/how-to-guides/administration/instance-admin-dashboard.md): Set up the DevGuard instance admin dashboard at /admin: generate an admin keypair with devguard-cli and configure the public key in your Helm chart.
- [Monitoring & Metrics](https://docs.devguard.org/how-to-guides/administration/monitoring-metrics.md): DevGuard monitoring Prometheus metrics guide — available endpoints, alerting configuration, and Grafana dashboard setup for complete observability.
- [OIDC & Restricting Access](https://docs.devguard.org/how-to-guides/administration/restricting-access.md): Configure DevGuard OIDC access restriction — disable public registration, connect identity providers, and manage allowed users for your installation.
- [Uninstalling DevGuard](https://docs.devguard.org/how-to-guides/administration/uninstalling-devguard.md): How to uninstall DevGuard — remove containers, delete databases, clean up configuration files, and remove Helm releases from Kubernetes clusters.
- [How to Upgrade DevGuard to a New Version](https://docs.devguard.org/how-to-guides/administration/upgrade-devguard.md): Step-by-step guide to upgrade DevGuard version — Docker Compose upgrade procedure, Helm chart updates, and migration considerations for self-hosted instances.
- [Manage Compliance & Attestation Policies](https://docs.devguard.org/how-to-guides/compliance/attestation-policies.md): Create compliance-as-code rules and manage DevGuard attestation policies — monitor dashboards, track policy violations, and enforce supply chain security.
- [View Vulnerability Event History in DevGuard](https://docs.devguard.org/how-to-guides/compliance/audit-logs.md): Track decisions via vulnerability event history DevGuard — audit logs covering all compliance actions for regulatory reporting and security reviews.
- [Export SBOM Documents with DevGuard](https://docs.devguard.org/how-to-guides/compliance/export-sbom.md): Export SBOM DevGuard — download CycloneDX or SPDX Software Bill of Materials for compliance, vulnerability reporting, and security audits.
- [Track Compliance Posture in DevGuard](https://docs.devguard.org/how-to-guides/compliance/track-compliance-postures.md): Monitor security-control implementation across your organization, projects and repositories, attach real components as evidence and export an OSCAL plan.
- [Search for Components](https://docs.devguard.org/how-to-guides/dependency-management/component-search.md): Find and analyze search software components DevGuard across repositories — searching for specific packages, versions, and understanding their security impact.
- [Find Vulnerable Dependencies in Projects](https://docs.devguard.org/how-to-guides/dependency-management/find-vulnerable-deps.md): Find vulnerable dependencies across your projects with DevGuard — filtering packages by CVE severity, viewing affected versions, and fix recommendations.
- [Manage License Compliance with DevGuard](https://docs.devguard.org/how-to-guides/dependency-management/license-compliance.md): Manage license compliance DevGuard — monitor component licenses and identify obligations, violations, and incompatibilities across your codebase easily.
- [Override License Decisions in DevGuard](https://docs.devguard.org/how-to-guides/dependency-management/override-license-decisions.md): Override license decisions DevGuard — correct or replace detected component licenses to ensure accurate compliance reporting for all dependencies.
- [View Dependency Tree and Vulnerabilities](https://docs.devguard.org/how-to-guides/dependency-management/view-dependency-tree.md): View dependency tree vulnerabilities in DevGuard — explore component relationships, transitive dependencies, and license obligations in an interactive graph.
- [Dependency Proxy with Malicious Package Firewall](https://docs.devguard.org/how-to-guides/dependency-proxy/index.md): DevGuard dependency proxy malicious packages firewall — blocks risky packages on download, scans dependencies, and enforces supply chain security policies.
- [DevGuard Cache Management](https://docs.devguard.org/how-to-guides/dependency-proxy/cache-management.md): Configure and manage the dependency proxy cache to optimize package downloads and control which packages are available to your development teams via DevGuard.
- [Setup Go Proxy with DevGuard Dependency Proxy](https://docs.devguard.org/how-to-guides/dependency-proxy/setup-go-proxy.md): Configure Go modules to route package downloads through the DevGuard dependency proxy for malicious package detection and supply chain security.
- [Setup npm Proxy with DevGuard Dependency Proxy](https://docs.devguard.org/how-to-guides/dependency-proxy/setup-npm-proxy.md): Configure npm to route package downloads through the DevGuard dependency proxy for malicious package detection and supply chain security.
- [Setup PyPI Proxy with DevGuard Dependency Proxy](https://docs.devguard.org/how-to-guides/dependency-proxy/setup-pypi-proxy.md): Configure pip and Python tools to route package downloads through the DevGuard dependency proxy for malicious package blocking and supply chain security.
- [DevGuard VSCode Extension: Inline Dependency Risk in Your Editor](https://docs.devguard.org/how-to-guides/integrations/devguard-for-vscode.md): Introduce the DevGuard VS Code extension — inline dependency risk badges, asset-aware hovers, SBOM actions, dependency proxy setup, and git hook automation.
- [Set Up GitHub Integration](https://docs.devguard.org/how-to-guides/integrations/github/setup-github-integration.md): Step-by-step guide to setup DevGuard GitHub integration — install the GitHub App, sync repositories, and enable automatic security scanning.
- [Set-up GitLab Integration](https://docs.devguard.org/how-to-guides/integrations/gitlab/setup-gitlab-integration.md): Step-by-step guide to connect DevGuard with GitLab — configure OAuth, sync groups and repositories, and enable CI/CD security scanning components.
- [Kubernetes DevGuard Integration](https://docs.devguard.org/how-to-guides/integrations/kubernetes-devguard-integration.md): Automatically discover and scan every container image in your Kubernetes cluster with DevGuard — SBOM generation, vulnerability detection, and auto-cleanup.
- [DevGuard MCP Server – Model Context Protocol Integration](https://docs.devguard.org/how-to-guides/integrations/mcp-server.md): Connect Claude and other MCP-compatible AI assistants to DevGuard — scan repositories, manage vulnerabilities, and triage risks directly from chat.
- [DevGuard Webhook Events Reference Guide](https://docs.devguard.org/how-to-guides/integrations/webhook-events.md): Complete reference of DevGuard webhook events — event types, payload formats, and how to configure subscriptions for integrations and automations.
- [How the DevGuard CI Scanner Handles Branches, Tags & Artifacts](https://docs.devguard.org/how-to-guides/scanning/branches-tags-and-artifacts.md): Learn how the DevGuard CI scanner handles refs and artifact names, why you should not add @branch or @version to names, and how every branch/tag gets scanned.
- [Provide Supplementary SBOMs for Unresolved Binaries](https://docs.devguard.org/how-to-guides/scanning/provide-supplementary-sboms.md): Step-by-step guide to writing and shipping a supplementary SBOM so devguard-scanner can resolve binaries like a statically-linked Go tool or Redis itself.
- [Scan with GitHub Actions](https://docs.devguard.org/how-to-guides/scanning/scan-with-github-actions.md): Integrate DevGuard GitHub Actions scanning into your CI/CD pipeline — running SCA, SAST, container scanning, and secret detection in automated workflows.
- [DevGuard Scan with GitLab CI](https://docs.devguard.org/how-to-guides/scanning/scan-with-gitlab-ci.md): Integrate DevGuard GitLab CI scanning into your pipeline using GitLab CI components for SCA, SAST, container scanning, and secret detection workflows.
- [Scan Dependencies, Code, and Images](https://docs.devguard.org/how-to-guides/scanning/scan-your-project.md): Scan dependencies, source code, and Docker images for vulnerabilities with DevGuard — SCA, SAST, secret scanning, IaC, container scanning, and SBOM upload.
- [DevGuard Scheduled Scans](https://docs.devguard.org/how-to-guides/scanning/scheduled-scans.md): Automate continuous monitoring with scheduled security scans DevGuard — covering dependencies, containers, and source code scanning in CI/CD pipelines.
- [Upload VEX Document to DevGuard](https://docs.devguard.org/how-to-guides/scanning/upload-vex.md): Upload VEX document DevGuard to mark vulnerabilities as not affected, in triage, or remediated for compliance reporting and auditable security decisions.
- [Working with VEX in DevGuard](https://docs.devguard.org/how-to-guides/vex/index.md): Record, automate, import and publish VEX in DevGuard — choose between a vulnerability event, an automated VEX rule, or your own advisory.
- [Export & Publish VEX](https://docs.devguard.org/how-to-guides/vex/export-vex.md): Publish VEX from DevGuard — download CycloneDX and OpenVEX documents, serve always-current public URLs, and act as a CSAF trusted provider.
- [Import VEX from Files & Suppliers](https://docs.devguard.org/how-to-guides/vex/import-vex.md): Import VEX into DevGuard — upload a CycloneDX file, add a CycloneDX or CSAF supplier URL, and control the sync with Paranoid Mode.
- [Prove a Finding Is Not Exploitable](https://docs.devguard.org/how-to-guides/vex/prove-not-affected.md): Prove a finding is not exploitable with binary symbol analysis — investigate Debian packages with nm, then record the result in DevGuard.
- [Create & Manage VEX Rules](https://docs.devguard.org/how-to-guides/vex/vex-rules.md): Automate VEX decisions with DevGuard VEX rules — write a CEL expression once and apply the same decision to every matching vulnerability.
- [Create Your Own Security Advisories in DevGuard](https://docs.devguard.org/how-to-guides/vulnerability-management/create-security-advisories.md): Author, publish and withdraw a security advisory in DevGuard — write your own vulnerability reports, score them with CVSS and share them as CSAF documents.
- [Create Vulnerability Events](https://docs.devguard.org/how-to-guides/vulnerability-management/create-vuln-events.md): Document assessments and enable vulnerability event tracking in DevGuard — recording triage decisions, state changes, and audit evidence for every finding.
- [CSAF Reports in DevGuard](https://docs.devguard.org/how-to-guides/vulnerability-management/csaf-common-security-advisory-framework.md): Publish and manage CSAF security advisory DevGuard documents — generating Common Security Advisory Framework reports for structured vulnerability disclosure.
- [Customize Risk Scores](https://docs.devguard.org/how-to-guides/vulnerability-management/customize-risk-scores.md): Learn how to customize vulnerability risk scores in DevGuard using asset context, business criticality, and environmental factors to prioritize remediation.
- [Sync External Upstream Data](https://docs.devguard.org/how-to-guides/vulnerability-management/sync-external-data.md): Produce and consume upstream SBOM and VEX documents to sync upstream vulnerability data with DevGuard and keep your security findings current and accurate.
- [DevGuard Track Fix Progress](https://docs.devguard.org/how-to-guides/vulnerability-management/track-fix-progress.md): Monitor vulnerability remediation tracking from discovery to resolution in DevGuard — track fix progress, assignments, and deadlines across all your assets.

## Reference

- [DevGuard API Reference](https://docs.devguard.org/reference/index.md): Complete REST API reference for DevGuard — endpoints, authentication, request/response formats, and integration examples for the DevGuard platform API.
- [DevGuard Artifacts API — REST API Reference](https://docs.devguard.org/reference/api/artifacts.md): Manage build artifacts in DevGuard. Upload, retrieve, and delete artifacts linked to your software assets and asset versions via the REST API.
- [DevGuard Asset Versions API — REST API Reference](https://docs.devguard.org/reference/api/asset-versions.md): Manage asset versions in DevGuard. List, retrieve, and delete versioned snapshots of your software assets tracked in the platform.
- [DevGuard Assets API — REST API Reference](https://docs.devguard.org/reference/api/assets.md): Manage assets in DevGuard. Create, list, update, and delete software assets such as repositories and container images tracked by DevGuard.
- [DevGuard Attestations API — REST API Reference](https://docs.devguard.org/reference/api/attestations.md): Work with attestations in DevGuard. Upload and retrieve in-toto attestations linked to build artifacts to prove supply chain integrity.
- [DevGuard Authentication API — REST API Reference](https://docs.devguard.org/reference/api/authentication.md): Manage authentication in DevGuard. Create and revoke personal access tokens and retrieve session information for API integrations.
- [DevGuard CSAF API — REST API Reference](https://docs.devguard.org/reference/api/csaf.md): Access CSAF documents in DevGuard. Retrieve Common Security Advisory Framework reports and aggregator metadata for your tracked vulnerabilities.
- [DevGuard CVE Database API — REST API Reference](https://docs.devguard.org/reference/api/cve-database.md): Search the CVE database in DevGuard. Query and filter the full CVE dataset with severity, CVSS scores, and affected package information.
- [DevGuard CVE API — REST API Reference](https://docs.devguard.org/reference/api/cve.md): Query CVE details in DevGuard. Retrieve Common Vulnerabilities and Exposures records including severity scores and remediation guidance for your assets.
- [DevGuard External Entity API — REST API Reference](https://docs.devguard.org/reference/api/external-entity.md): Ingest SBOMs from external inventory providers into DevGuard. Upsert and delete dynamically managed project hierarchies keyed by your own external entity IDs.
- [DevGuard External References API — REST API Reference](https://docs.devguard.org/reference/api/externalreferences.md): Manage external references in DevGuard. Link and retrieve external URLs and identifiers associated with your assets and vulnerabilities.
- [DevGuard Integrations API — REST API Reference](https://docs.devguard.org/reference/api/integrations.md): Configure integrations in DevGuard. Connect GitLab, GitHub, Jira, and other external services to your DevGuard organizations and projects.
- [DevGuard Organizations API — REST API Reference](https://docs.devguard.org/reference/api/organizations.md): Manage organizations in DevGuard. Create, update, and administer organizations, members, and invitations in your DevGuard deployment.
- [DevGuard Projects API — REST API Reference](https://docs.devguard.org/reference/api/projects.md): Manage projects in DevGuard. Create and configure security projects that group assets, scan policies, and vulnerability findings together.
- [DevGuard Releases API — REST API Reference](https://docs.devguard.org/reference/api/releases.md): Manage releases in DevGuard. Create and retrieve software release records linked to your asset versions and their associated artifacts.
- [DevGuard Scanning API — REST API Reference](https://docs.devguard.org/reference/api/scanning.md): Trigger and manage scans in DevGuard. Start dependency, container image, and SAST scans and retrieve findings for your software assets via the API.
- [DevGuard Statistics API — REST API Reference](https://docs.devguard.org/reference/api/statistics.md): Retrieve statistics in DevGuard. Query aggregated vulnerability counts, risk scores, and trend data for your organizations and projects.
- [DevGuard VEX Rules API — REST API Reference](https://docs.devguard.org/reference/api/vexrules.md): Manage VEX rules in DevGuard. Create and retrieve VEX justification rules that mark vulnerabilities as not affected across your assets.
- [DevGuard Vulnerability Database API — REST API Reference](https://docs.devguard.org/reference/api/vulndb.md): Query the DevGuard vulnerability database. Search and retrieve enriched vulnerability records used to match findings in your scanned assets.
- [DevGuard Vulnerabilities API — REST API Reference](https://docs.devguard.org/reference/api/vulnerabilities.md): Manage vulnerabilities in DevGuard. List, filter, triage, and update the vulnerability findings detected across your assets and projects via the API.
- [DevGuard Webhooks API — REST API Reference](https://docs.devguard.org/reference/api/webhooks.md): Configure webhooks in DevGuard. Register and manage webhook endpoints to receive real-time event notifications from your DevGuard projects.
- [Build Image GitHub Workflow](https://docs.devguard.org/reference/github-workflows/build-image.md): Reference for the DevGuard build-image GitHub Actions workflow — build and archive Docker images with Kaniko, artifact upload, and digest tracking.
- [Code Risk Identification GitHub Workflow](https://docs.devguard.org/reference/github-workflows/code-risk-identification.md): Reference for the DevGuard code-risk-identification GitHub Actions workflow — analyze SARIF files to identify security vulnerabilities
- [Container Scanning GitHub Workflow](https://docs.devguard.org/reference/github-workflows/container-scanning.md): Reference for the DevGuard container-scanning GitHub Actions workflow — scan Docker images for known CVEs and generate SBOMs for container security.
- [Dependency Risk Identification GitHub Workflow](https://docs.devguard.org/reference/github-workflows/dependency-risk-identification.md): Reference for the DevGuard dependency-risk-identification GitHub Actions workflow — detect vulnerable third-party dependencies and generate SBOMs in CI/CD.
- [Deploy GitHub Workflow](https://docs.devguard.org/reference/github-workflows/deploy.md): Reference for the DevGuard deploy GitHub Actions workflow — deploy OCI images to your infrastructure with security validation and attestation checks.
- [Full DevGuard Scan GitHub Workflow](https://docs.devguard.org/reference/github-workflows/full-scan.md): Reference for the DevGuard full-scan GitHub Actions workflow — comprehensive security scanning including container, SAST, SCA, and secrets
- [Infrastructure as Code (IaC) GitHub Workflow](https://docs.devguard.org/reference/github-workflows/iac.md): Reference for the DevGuard IaC GitHub Actions workflow — scan infrastructure code for security misconfigurations and policy violations using SARIF reporting.
- [Static Application Security Testing (SAST) GitHub Workflow](https://docs.devguard.org/reference/github-workflows/sast.md): Reference for the DevGuard SAST GitHub Actions workflow — analyze source code for security vulnerabilities using static analysis and SARIF report integration.
- [Software Composition Analysis (SCA) GitHub Workflow](https://docs.devguard.org/reference/github-workflows/sca.md): Reference for the DevGuard SCA GitHub Actions workflow — detect vulnerabilities in third-party dependencies and generate SBOMs for software composition.
- [Secret Scanning GitHub Workflow](https://docs.devguard.org/reference/github-workflows/secret-scanning.md): Reference for the DevGuard secret-scanning GitHub Actions workflow — detect leaked API keys, passwords, and secrets in source code
- [Sign GitHub Workflow](https://docs.devguard.org/reference/github-workflows/sign.md): Reference for the DevGuard sign GitHub Actions workflow — sign artifacts to ensure code integrity, generate attestations, and verify supply chain.
- [Build Image GitLab Component](https://docs.devguard.org/reference/gitlab-components/build-image.md): Reference for the DevGuard build-image GitLab component — build and archive Docker images using Kaniko with integrated tagging and digest retrieval in CI/CD.
- [Code Risk Identification GitLab Component](https://docs.devguard.org/reference/gitlab-components/code-risk-identification.md): Reference for the DevGuard code-risk-identification GitLab component — analyze SARIF files to identify security vulnerabilities in code
- [Container Scanning GitLab Component](https://docs.devguard.org/reference/gitlab-components/container-scanning.md): Reference for the DevGuard container-scanning GitLab component — scan Docker images for known vulnerabilities and generate SBOMs directly in your CI pipeline.
- [Dependency Risk Identification GitLab Component](https://docs.devguard.org/reference/gitlab-components/dependency-risk-identification.md): Reference for the DevGuard dependency-risk-identification GitLab component — analyze third-party dependencies for CVEs and generate SBOMs in your pipeline.
- [Deploy GitLab Component](https://docs.devguard.org/reference/gitlab-components/deploy.md): Reference for the DevGuard deploy GitLab component — deploy OCI images to the GitLab container registry after security checks pass
- [Full DevGuard Scan GitLab Component](https://docs.devguard.org/reference/gitlab-components/full-scan.md): Reference for the DevGuard full-scan GitLab component — run comprehensive security scanning including container, SAST, SCA, and secrets
- [Infrastructure as Code (IaC) GitLab Component](https://docs.devguard.org/reference/gitlab-components/iac.md): Reference for the DevGuard IaC GitLab component — scan infrastructure code for security misconfigurations and compliance policy violations in CI/CD.
- [Static Application Security Testing (SAST) Gitlab Component](https://docs.devguard.org/reference/gitlab-components/sast.md): Configure the DevGuard SAST GitLab component to scan source code for vulnerabilities. See all available inputs, defaults, and usage examples.
- [Software Composition Analysis (SCA) GitLab Component](https://docs.devguard.org/reference/gitlab-components/sca.md): Reference for the DevGuard SCA GitLab component — detect vulnerabilities in third-party dependencies, generate SBOMs, and track license compliance in CI/CD.
- [Secret Scanning GitLab Component](https://docs.devguard.org/reference/gitlab-components/secret-scanning.md): Reference for the DevGuard secret-scanning GitLab component — detect leaked API keys, passwords, and credentials in source code and git history.
- [Sign GitLab Component](https://docs.devguard.org/reference/gitlab-components/sign.md): Reference for the DevGuard sign GitLab component — sign artifacts to ensure code integrity, generate cryptographic attestations, and verify supply chain.
- [DevGuard-Scanner attest — Create and upload an attestation](https://docs.devguard.org/reference/scanner/attest.md): Attach a signed predicate to a container image or artifact and upload it to DevGuard with devguard-scanner attest for verifiable build provenance.
- [DevGuard-Scanner attestations — Discover and evaluate image attestations](https://docs.devguard.org/reference/scanner/attestations.md): Discover all attestations attached to a container image and optionally evaluate them against a Rego policy with devguard-scanner attestations.
- [DevGuard-Scanner auth — Verify and store a token](https://docs.devguard.org/reference/scanner/auth.md): Verify a DevGuard personal access token and store it in the OS keyring with devguard-scanner auth so you no longer need to pass --token on every command.
- [DevGuard-Scanner clean — Remove attestations or signatures](https://docs.devguard.org/reference/scanner/clean.md): Remove attestations and signatures from an OCI image with devguard-scanner clean, optionally limiting the cleanup to signatures, attestations, or SBOMs.
- [DevGuard-Scanner container-scanning — Container image SCA](https://docs.devguard.org/reference/scanner/container-scanning.md): Run software composition analysis on a container image with devguard-scanner container-scanning, generating or uploading an SBOM that DevGuard analyzes for vulnerabilities.
- [DevGuard-Scanner curl — Signed HTTP requests](https://docs.devguard.org/reference/scanner/curl.md): Make curl-compatible HTTP requests with devguard-scanner curl, automatically signing them with your DevGuard Personal Access Token for authentication.
- [DevGuard-Scanner — Secure your software supply chain](https://docs.devguard.org/reference/scanner/devguard-scanner.md): DevGuard Scanner is a CLI to generate, sign and upload SBOMs, SARIF reports and attestations to a DevGuard backend and secure your software supply chain.
- [DevGuard-Scanner discover-baseimage-attestations — fetch base image attestations](https://docs.devguard.org/reference/scanner/discover-baseimage-attestations.md): Read a Dockerfile's FROM line and download attestations such as SBOM and VEX documents attached to the base image using devguard-scanner.
- [DevGuard-Scanner intoto fetch-links — Fetch supply chain links](https://docs.devguard.org/reference/scanner/fetch-links.md): Download the signed in-toto links recorded for a given supply chain ID from DevGuard so they can be inspected or verified locally.
- [DevGuard-Scanner generate-tag — build a container image tag from metadata](https://docs.devguard.org/reference/scanner/generate-tag.md): Generate a container image tag, artifact name, and URL-encoded artifact name from build parameters like version, ref, and architecture with devguard-scanner.
- [DevGuard-Scanner get — Authenticated GET request](https://docs.devguard.org/reference/scanner/get.md): Perform a simple GET request signed with a DevGuard Personal Access Token using devguard-scanner get; deprecated in favor of the curl command.
- [Help about any command](https://docs.devguard.org/reference/scanner/help.md): Help provides help for any command in the application. Simply type intoto help [path to command] for full details.
- [DevGuard-Scanner iac — Infrastructure-as-Code scan](https://docs.devguard.org/reference/scanner/iac.md): Run an Infrastructure-as-Code scan with devguard-scanner iac to check Terraform, CloudFormation, and Kubernetes manifests for misconfigurations and upload SARIF results to DevGuard.
- [DevGuard-Scanner inspect-devguard-token — Decode a DevGuard token](https://docs.devguard.org/reference/scanner/inspect-devguard-token.md): Decode a DevGuard hex token with devguard-scanner and print its corresponding private and public keys in PEM and hex formats for debugging.
- [](https://docs.devguard.org/reference/scanner/inspect.md): 
- [DevGuard-Scanner intoto — Record and verify supply chain steps](https://docs.devguard.org/reference/scanner/intoto.md): Record and verify software supply chain steps with in-toto, capturing signed cryptographic evidence at each stage of your CI pipeline and uploading it to DevGuard.
- [DevGuard-Scanner kyverno2sarif — Convert Kyverno test output to SARIF](https://docs.devguard.org/reference/scanner/kyverno2sarif.md): Convert the JSON output of 'kyverno test' into SARIF format with devguard-scanner kyverno2sarif so DevGuard and other SARIF-aware tools can ingest your Kubernetes policy results.
- [DevGuard-Scanner login — Log in to a container registry](https://docs.devguard.org/reference/scanner/login.md): Authenticate devguard-scanner with a remote container registry using a username and password so it can pull and push images.
- [DevGuard-Scanner merge-sboms — combine multiple SBOMs into one](https://docs.devguard.org/reference/scanner/merge-sboms.md): Merge multiple CycloneDX SBOMs from independently scanned components into a single combined SBOM ready to upload to DevGuard with devguard-scanner.
- [DevGuard-Scanner purl-inspect — inspect a PURL for CVEs and vulnerabilities](https://docs.devguard.org/reference/scanner/purl-inspect.md): Look up a package version by PURL in the DevGuard vulnerability database and display matching CVEs, CVSS scores, EPSS probability, and available fixes.
- [DevGuard-Scanner intoto run — Record a single-command step](https://docs.devguard.org/reference/scanner/run.md): Run a pipeline step as a single command, snapshot input and output file hashes around it, sign the resulting in-toto link and upload it to DevGuard.
- [DevGuard-Scanner sarif — Upload a SARIF report](https://docs.devguard.org/reference/scanner/sarif.md): Upload an existing SARIF report to DevGuard with devguard-scanner sarif to store findings from your own scanners without re-scanning the source files.
- [DevGuard-Scanner sarif2markdown — Convert SARIF to markdown](https://docs.devguard.org/reference/scanner/sarif2markdown.md): Convert a SARIF JSON file into a human-readable markdown report with devguard-scanner sarif2markdown for pull requests, wikis, or code review comments.
- [DevGuard-Scanner sast — run a static application security test](https://docs.devguard.org/reference/scanner/sast.md): Run a static application security test with semgrep against your project and upload the SARIF results to DevGuard with devguard-scanner.
- [DevGuard-Scanner sbom — Scan a CycloneDX SBOM](https://docs.devguard.org/reference/scanner/sbom.md): Upload a CycloneDX SBOM from a file or stdin with devguard-scanner sbom and let DevGuard analyze it for known vulnerabilities.
- [DevGuard-Scanner sca — run Software Composition Analysis](https://docs.devguard.org/reference/scanner/sca.md): Run Software Composition Analysis on a project or container image to generate an SBOM and return vulnerability results from DevGuard with devguard-scanner.
- [DevGuard-Scanner secret-scanning — detect leaked secrets in source code](https://docs.devguard.org/reference/scanner/secret-scanning.md): Scan a repository or directory for accidentally committed secrets using gitleaks and upload the SARIF results to DevGuard with devguard-scanner.
- [](https://docs.devguard.org/reference/scanner/setup.md): 
- [DevGuard-Scanner sign — Sign a file or container image](https://docs.devguard.org/reference/scanner/sign.md): Sign a local file or OCI image with cosign using devguard-scanner, optionally uploading the public key to DevGuard before creating the signature.
- [DevGuard-Scanner slug — Create a URL-friendly slug](https://docs.devguard.org/reference/scanner/slug.md): Turn arbitrary text into a URL-friendly slug with devguard-scanner slug, handy for generating artifact names or identifiers in scripts.
- [DevGuard-Scanner intoto start — Snapshot pipeline step inputs](https://docs.devguard.org/reference/scanner/start.md): Record the cryptographic hashes of all input files at the beginning of a pipeline step, to be paired with intoto stop into a signed in-toto link.
- [DevGuard-Scanner intoto stop — Snapshot outputs and upload the link](https://docs.devguard.org/reference/scanner/stop.md): Record the cryptographic hashes of all output files at the end of a pipeline step, sign the in-toto link with the DevGuard token and upload it to DevGuard.
- [DevGuard-Scanner intoto verify — Check supply chain verification status](https://docs.devguard.org/reference/scanner/verify.md): Query the DevGuard supply chain verification endpoint to confirm all required pipeline steps ran correctly, intended for automated deployment gates rather than direct use.
- [DevGuard-Scanner version — Show version information](https://docs.devguard.org/reference/scanner/version.md): Display version, commit, build date and builder information for the installed devguard-scanner CLI.
- [DevGuard-Scanner vex — Upload a VEX document](https://docs.devguard.org/reference/scanner/vex.md): Upload a CycloneDX VEX document to DevGuard with devguard-scanner vex to suppress non-exploitable CVEs so they no longer count against your risk score.
- [CEL Expression Reference for VEX Rules](https://docs.devguard.org/reference/vex-cel-reference.md): Complete CEL expression reference for DevGuard VEX rules — the vuln fields, the matchesPattern and matchesPurl helpers, and a cookbook.
- [DevGuard CVE Enrichment](https://docs.devguard.org/reference/vulnerability-database/cve-enrichment.md): How DevGuard enriches CVE data with exploitability signals, EPSS scores, and additional context to help teams prioritize which vulnerabilities to fix first.
- [OSSF Malicious Packages](https://docs.devguard.org/reference/vulnerability-database/malicious-packages.md): How DevGuard uses the OSSF malicious packages database to detect and block known malicious npm, PyPI, and other open source packages in your supply chain.
- [DevGuard Update Schedule](https://docs.devguard.org/reference/vulnerability-database/update-schedule.md): How DevGuard's vulnerability database is built, signed, distributed, and kept up to date — update frequency, data sources, and integrity verification process.

## Explanations

- [DevGuard Explanations Overview](https://docs.devguard.org/explanations/index.md): In-depth DevGuard concepts explained — DevSecOps pipeline, vulnerability management, compliance, supply chain security, SBOM, and platform integrations.
- [DevGuard Authentication Flow](https://docs.devguard.org/explanations/architecture/authentication-flow.md): How DevGuard handles authentication using Ory Kratos for session management, Personal Access Tokens for API access, and Casbin for role-based authorization.
- [DevGuard Security Model](https://docs.devguard.org/explanations/architecture/security-model.md): DevGuard's zero-trust security architecture — cryptographic request verification, BSI TR-03183, ISO 27001, and SOC 2 compliance by design.
- [Achieving SLSA Level 3 on GitLab](https://docs.devguard.org/explanations/attestations-provenance/slsa-level-3.md): Step-by-step guide to achieving SLSA Level 3 on GitLab — creating tamper-resistant build attestations using DevGuard and GitLab CI protected runners.
- [Audit Logging & Compliance Trail](https://docs.devguard.org/explanations/compliance/audit-trails.md): How DevGuard creates immutable audit trails for compliance evidence — tracking every vulnerability state change and system event for regulatory reporting.
- [Compliance as Code with DevSecOps Automation](https://docs.devguard.org/explanations/compliance/compliance-as-code.md): How DevGuard enables compliance as code DevSecOps — automating security policy enforcement and audit evidence generation directly within your CI/CD pipeline.
- [CSAF & VEX Standards](https://docs.devguard.org/explanations/compliance/csaf-vex-explained.md): Understand the CSAF & VEX standards — how CSAF, CycloneDX VEX and OpenVEX differ, what each one carries, and which to publish from DevGuard.
- [EU Cyber Resilience Act Compliance Guide](https://docs.devguard.org/explanations/compliance/cyber-resilience-act.md): Understand the EU Cyber Resilience Act compliance requirements and how DevGuard helps software manufacturers meet CRA mandates with automated SBOM generation.
- [ISO 27001 Controls - Annex A](https://docs.devguard.org/explanations/compliance/iso-27001-mapping.md): How DevGuard maps to ISO 27001 security controls mapping — automating evidence collection and continuous monitoring to support your ISMS certification.
- [SBOM Standards: CycloneDX and SPDX Compared](https://docs.devguard.org/explanations/compliance/sbom-standards.md): Compare the SBOM standards CycloneDX and SPDX. Understand when to use each for vulnerability management and license compliance reporting
- [Why Compliance Matters](https://docs.devguard.org/explanations/compliance/why-compliance-matters.md): Learn why software compliance security requirements matter — regulatory mandates like CRA and ISO 27001, managing liability, and building customer trust.
- [DevGuard Artifact Concept](https://docs.devguard.org/explanations/core-concepts/artifacts.md): Understand how DevGuard artifact tracking works across multiple build targets — Docker images, distributions, and deployment targets from one repository.
- [Open Standards First](https://docs.devguard.org/explanations/core-concepts/open-standards.md): DevGuard uses open standards security toolchain — SBOM, VEX, SARIF, SLSA — ensuring maximum compatibility and avoiding vendor lock-in across integrations.
- [DevGuard DevGuard Hierarchy](https://docs.devguard.org/explanations/core-concepts/organization-groups-repos.md): Learn how DevGuard organizations groups repositories work as a three-level hierarchy for managing security across your entire portfolio.
- [Repository Versions (Branches & Tags)](https://docs.devguard.org/explanations/core-concepts/repository-versions.md): Vulnerability tracking git branches and tags in DevGuard — independent security findings per branch and tag that mirror your Git workflow.
- [Vulnerability Risk Scoring in DevGuard](https://docs.devguard.org/explanations/core-concepts/risk-scoring.md): Learn how DevGuard calculates vulnerability risk scoring using CVSS, EPSS, and contextual factors to prioritize by actual threat, not just severity.
- [Dependency Risk vs First-Party Risk](https://docs.devguard.org/explanations/core-concepts/vulnerability-types.md): How DevGuard distinguishes dependency risk first-party vulnerability — third-party component risk via SBOM versus code-level risk via SARIF scanning.
- [What is DevGuard? Open-Source Security Platform](https://docs.devguard.org/explanations/core-concepts/what-is-devguard.md): What is DevGuard? An open-source vulnerability management platform built for developers to integrate security into the software development lifecycle.
- [DevGuard Container Scanning](https://docs.devguard.org/explanations/devsecops/container-scanning.md): Learn how to scan your container images for vulnerabilities with DevGuard by analyzing Docker image SBOMs against known CVEs and security advisories.
- [Dynamic Application Security Testing (DAST)](https://docs.devguard.org/explanations/devsecops/dast.md): Understand DAST — how DevGuard integrates dynamic application security testing to find runtime vulnerabilities by actively probing running applications.
- [Infrastructure as Code (IaC) Scanning](https://docs.devguard.org/explanations/devsecops/iac.md): Learn how DevGuard performs infrastructure as code security scanning of Terraform, Kubernetes, and Helm templates for misconfigurations before deployment.
- [Static Application Security Testing (SAST)](https://docs.devguard.org/explanations/devsecops/sast.md): Understand static application security testing and how DevGuard integrates SAST tools to detect source code vulnerabilities before production using SARIF.
- [Secret Scanning for Git Credentials](https://docs.devguard.org/explanations/devsecops/secret-scanning.md): Learn how DevGuard performs secret scanning of source code and git history — detecting API keys, passwords, and tokens to prevent leaks in CI/CD pipelines.
- [Software Composition Analysis (SCA)](https://docs.devguard.org/explanations/devsecops/software-composition-analysis.md): Understand software composition analysis and how DevGuard scans third-party dependencies for known CVEs, generates SBOMs, and tracks vulnerable components.
- [Understanding the OWASP DevSecOps Pipeline](https://docs.devguard.org/explanations/devsecops/understanding-owasp-devsecops-pipeline.md): How DevGuard implements the OWASP DevSecOps pipeline — covering each security stage from SAST and SCA to container scanning and secret detection in CI/CD.
- [External Entity Providers](https://docs.devguard.org/explanations/integrations/external-entity-providers.md): How DevGuard integrates with external entity providers — syncing users, groups, and repositories from GitHub, GitLab, and other identity sources.
- [DevGuard GitHub Integration](https://docs.devguard.org/explanations/integrations/github-integration.md): How DevGuard integrates with GitHub — automatic repository sync, GitHub Actions security scanning, issue creation, and permission management via GitHub App.
- [DevGuard GitLab Integration](https://docs.devguard.org/explanations/integrations/gitlab-integration.md): How DevGuard integrates with GitLab — CI/CD components, automatic repository sync, merge request security gates, and permission management via GitLab OAuth.
- [Integration Architecture](https://docs.devguard.org/explanations/integrations/integration-architecture.md): How DevGuard's integration layer works — webhooks, event-driven sync, OAuth flows, and the architecture connecting DevGuard to GitHub, GitLab, and Jira.
- [DevGuard Jira Integration](https://docs.devguard.org/explanations/integrations/jira-integration.md): How DevGuard integrates with Jira — automatically creating issues for detected vulnerabilities, syncing remediation status, and linking security findings.
- [Open Source License Compliance with DevGuard](https://docs.devguard.org/explanations/license-management/license-compliance.md): How DevGuard detects open source license compliance obligations in your dependencies and enforces license policies to avoid legal risks.
- [Software License Detection via SBOM Analysis](https://docs.devguard.org/explanations/license-management/license-detection.md): How DevGuard performs software license detection SBOM analysis — supporting SPDX identifiers and CycloneDX license fields to identify dependency obligations.
- [Personal Access Tokens](https://docs.devguard.org/explanations/personal-access-token.md): How DevGuard personal access tokens work — asymmetric ECDSA request signing and symmetric Bearer tokens, including scopes, expiry, and security properties.
- [Dependency Proxy Security](https://docs.devguard.org/explanations/security/dependency-proxy-security.md): How the DevGuard dependency proxy enforces security through malicious package blocking, cache integrity, and initialization protection
- [Supplementary SBOMs — Filling the Gaps Trivy Can't](https://docs.devguard.org/explanations/supplementary-sboms.md): How DevGuard merges supplementary SBOMs to fix components that container scans miss, and why it refuses to guess when two sources disagree.
- [Supply Chain Attestations](https://docs.devguard.org/explanations/supply-chain-security/attestations.md): What are software supply chain attestations? Learn how signed statements about build artifacts enable explicit verification in a zero-trust supply chain.
- [In-Toto Supply Chain Security Framework Documentation](https://docs.devguard.org/explanations/supply-chain-security/in-toto-framework.md): In-toto supply chain security framework documentation: learn how cryptographic step-linking prevents tampering from source code to production.
- [Software Provenance Tracking with DevGuard](https://docs.devguard.org/explanations/supply-chain-security/provenance-tracking.md): How DevGuard implements software provenance tracking — recording where each artifact came from, who built it, and establishing a verifiable chain of custody.
- [DevGuard The SLSA Framework](https://docs.devguard.org/explanations/supply-chain-security/slsa-framework.md): Understand the SLSA (Supply chain Levels for Software Artifacts) security framework, a maturity model to harden your build process against attacks.
- [What is a Supply Chain Attack? Definition & Classification](https://docs.devguard.org/explanations/supply-chain-security/supply-chain-attack.md): A supply chain attack combines two attacks: one on a trusted supplier, one on the real target. Learn how it works and how to defend with SLSA and in-toto.
- [Software Supply Chain Verification with DevGuard](https://docs.devguard.org/explanations/supply-chain-security/supply-chain-verification.md): How to perform software supply chain verification — checking SBOM signatures, attestations, and provenance records to confirm artifacts haven't been tampered.
- [Transitive Vulnerability Path Analysis: The Quickfix Algorithm](https://docs.devguard.org/explanations/supply-chain-security/transitive-vulnerability-path-analysis.md): Explore the transitive vulnerability path analysis: the documentation. Learn about vulnerability management and compliance with DevGuard open-source platform.
- [What is Software Supply Chain Security?](https://docs.devguard.org/explanations/supply-chain-security/what-is-supply-chain-security.md): Learn what software supply chain security means, which threats exist, and how DevGuard helps teams mitigate risks across the software development lifecycle.
- [Transitive Dependency Risks and Vulnerabilities Explained](https://docs.devguard.org/explanations/transitive-dependencies.md): What is a transitive dependency? Learn how a transitive dependency introduces hidden vulnerabilities and how DevGuard surfaces them per node.
- [Vulnerability Mitigation Strategies](https://docs.devguard.org/explanations/vulnerability-management/mitigation-strategies.md): Explore vulnerability mitigation strategies in DevGuard — patching, version pinning, accepting risk with justifications, and VEX statements.
- [Reduce False Positives](https://docs.devguard.org/explanations/vulnerability-management/reduce-false-positives.md): How to reduce false positives in vulnerability scanning: DevGuard uses 22+ data sources, backported patch detection, and VEX to cut noisy findings.
- [Vulnerability Risk Assessment Methodology](https://docs.devguard.org/explanations/vulnerability-management/risk-assessment-methodology.md): How DevGuard applies vulnerability risk assessment methodology — combining CVSS, EPSS probability, reachability analysis, and environmental factors.
- [Schwachstellen Management in der Softwareentwicklung](https://docs.devguard.org/explanations/vulnerability-management/schwachstellen-management.md): Warum Schwachstellen Management in moderner Softwareentwicklung unverzichtbar ist – und wie es die Compliance mit CRA, NIS2, DORA und ISO 27001 ermöglicht.
- [Vulnerability Event System](https://docs.devguard.org/explanations/vulnerability-management/vulnerability-events.md): How DevGuard's vulnerability event tracking records every state change — from discovery to remediation — providing a complete audit trail.
- [Vulnerability Lifecycle Management](https://docs.devguard.org/explanations/vulnerability-management/vulnerability-lifecycle.md): The complete vulnerability lifecycle management in DevGuard — from initial detection through triage, remediation, and verification with state transitions.
- [Vulnerability Management Overview](https://docs.devguard.org/explanations/vulnerability-management/vulnerability-management-overview.md): Learn why vulnerability management is essential in software development and how it underpins compliance with the CRA, NIS2, DORA, and ISO 27001.
- [Vulnerability Matching SBOM Components in DevGuard](https://docs.devguard.org/explanations/vulnerability-management/vulnerability-matching.md): How DevGuard performs vulnerability matching SBOM components against the vulnerability database using PURL and CPE identifiers to find vulnerable packages.
- [What is a VEX Report](https://docs.devguard.org/explanations/vulnerability-management/what-is-vex.md): Understand the VEX standard for vulnerabilities — the problem it solves, its status values and justifications, and the CSAF, CycloneDX, and OpenVEX formats.

## Comparison

- [DevGuard Comparison Security Tools Overview](https://docs.devguard.org/comparison/index.md): DevGuard comparison security tools — see how DevGuard stacks up against Snyk, Semgrep, Dependency-Track, Aikido, and others feature by feature.
- [AboutCode vs DevGuard](https://docs.devguard.org/comparison/aboutcode.md): AboutCode vs DevGuard — key differences in philosophy, feature sets, integration approach, and use cases for open source security and compliance teams.

## Contributing

- [DevGuard Code of Conduct for Contributors](https://docs.devguard.org/contributing/code-of-conduct.md): DevGuard code of conduct — community standards for respectful and inclusive participation, reporting guidelines, and enforcement policies for contributors.
- [DevGuard Setup Guide](https://docs.devguard.org/contributing/getting-started.md): How to contribute to DevGuard — setup, development environment, architecture overview, and contribution guidelines for the open-source security platform.
- [DevGuard Roadmap and Upcoming Features](https://docs.devguard.org/contributing/roadmap.md): Explore the DevGuard roadmap — planned improvements, community-requested capabilities, and the long-term vision for the open-source security platform.

## Other

- [DevGuard Acknowledgements](https://docs.devguard.org/other/acknowledgements.md): Projects and contributors that DevGuard builds upon and gratefully acknowledges — open source libraries, tools, and community members powering the platform.
- [DevGuard Community](https://docs.devguard.org/other/community.md): Join the DevGuard community on our Monthly Open Community Call — every last Thursday at 17:00 UTC+2 to discuss releases, roadmap, and open issues.
- [DevGuard Sponsors & Partners](https://docs.devguard.org/other/sponsors-partners.md): Organizations and partners supporting DevGuard's open source security platform — sponsors, contributors, and ecosystem partners advancing DevSecOps tooling.