| What it does | Self-hosted application security and software composition analysis for open-source dependencies
| Search billions of TLS certificates from all public Certificate Transparency logs by domain, wildcard, organization, serial number or SHA-256 fingerprint
|
|---|
| Stage | Not given
| Not given
|
|---|
| Founded | Not given
| Not given
|
|---|
| Based in | Not given
| FR
|
|---|
| Pricing model | Freemium
| Not given
|
|---|
| Pricing | Scanner: Free for open source and organizations under $1M revenue; includes every repository, full transitive resolution for Java, JavaScript, Python, Go, license audit, OSV advisories with CI gate, HTML report and CycloneDX SBOM. Over $1M revenue, the Scanner license adds priority support and polic
| Not given
|
|---|
| Key features | - Full transitive dependency tree resolution for Java, JavaScript, Python, and Go
- License classification and audit with allowed, review, and forbidden categories
- OSV advisory screening for vulnerability detection
- CycloneDX SBOM generation on every scan
- CI gate with configurable fail-on levels
- Dev and test dependency detection and flagging
- Runs as GitHub Action or self-hosted container
- Waivers with append-only audit trail for Hub
- Coverage reporting showing how much of dependency tree was resolved
| - Search by domain, wildcard, organization, serial number, SHA-256 fingerprint and public key (SPKI)
- Index of 28.5 billion certificates across 88 active and 111 archived CT logs
- 6.5 billion distinct hostnames with first-seen and last-seen dates, certificates back to 2013
- Fast API: domain lookup 25-30 ms, subdomains 45-50 ms
- Subdomain finder with certificate counts and first/last seen dates
- BIMI brand logos from verified mark certificate logs
- CAA record checker showing records as CAs see them and CAs that issued for a domain
- Free JSON API with cursor pagination and anonymous use
- Machine-readable documentation at llms.txt for AI agents
- Continuous ingestion of all public CT logs with live coverage metrics
|
|---|
| What makes it different | - Uses open OSV advisory data instead of proprietary vulnerability database
- Maven resolution directly from source with no build or lockfile needed
- Single container with no standing service or platform team required to operate
- Priced per product with all developers and repositories included, not per seat or per committer
| - Searches all public Certificate Transparency logs continuously ingested into a single index
- Reveals subdomains hidden from DNS enumeration and web crawls through certificate search
|
|---|
| Free plan | Not given
| Not given
|
|---|
| Open source | Not given
| Not given
|
|---|
| Platforms | Not given
| Not given
|
|---|
| Public API | Not given
| Not given
|
|---|
| Community votes | 0 | 0 |
|---|
| DR (Domain Rating by Ahrefs) | 14 ● no change since last check | 38 ● no change since last check |
|---|
| Trust Flow (Majestic) | 5 | 18 |
|---|
| Citation Flow (Majestic) | 24 | 29 |
|---|
| Referring domains (Majestic) | 24 | 76 |
|---|
depproof
ctlogs.dev