| What it does | Security engineer and penetration tester offering expert security consulting and code review
| Self-hosted application security and software composition analysis for open-source dependencies
|
|---|
| Stage | Established
| Not given
|
|---|
| Founded | Not given
| Not given
|
|---|
| Based in | PL
| Not given
|
|---|
| Pricing model | Contact for pricing
| Freemium
|
|---|
| Pricing | Invoicing in EUR or PLN; prepaid blocks upfront; project or retainer per statement of work
| Scanner: Free for open source and organizations under $1M revenue; includes every repository, full transitive resolution for Java, JavaScript, Python, Go, license audit, OSV advisories with CI gate, HTML report and CycloneDX SBOM. Over $1M revenue, the Scanner license adds priority support and polic
|
|---|
| Key features | - Penetration testing for software including web, mobile, desktop, cloud and CI/CD systems
- Network and service infrastructure security review
- First-party source code review for vulnerabilities and risky patterns
- Third-party code and dependency review for supply chain risk assessment
- Security architecture for new and existing systems
- Security tooling design and engineering
- Incident response and crisis management support
- Workshops and talks for developers and security teams
| - Full transitive dependency tree resolution for Java, JavaScript, Python, and Go
- License classification and audit with allowed, review, and forbidden categories
- OSV advisory screening for vulnerability detection
- CycloneDX SBOM generation on every scan
- CI gate with configurable fail-on levels
- Dev and test dependency detection and flagging
- Runs as GitHub Action or self-hosted container
- Waivers with append-only audit trail for Hub
- Coverage reporting showing how much of dependency tree was resolved
|
|---|
| What makes it different | - 12+ years of security experience with previous role at Opera Software managing security and bug bounty programs
- Calls out insecure designs plainly with evidence and specific solutions rather than security theatre
- Focus on durable, material improvements to security with lasting impact
- Holistic approach including user experience and product perspective beyond just security
- Extreme ownership, customer obsession, and focus on making real impact
| - Uses open OSV advisory data instead of proprietary vulnerability database
- Maven resolution directly from source with no build or lockfile needed
- Single container with no standing service or platform team required to operate
- Priced per product with all developers and repositories included, not per seat or per committer
|
|---|
| Free plan | Not given
| Not given
|
|---|
| Open source | Not given
| Not given
|
|---|
| Platforms | Not given
| Not given
|
|---|
| Public API | Not given
| Not given
|
|---|
| Community votes | 0 | 0 |
|---|
| DR (Domain Rating by Ahrefs) | 55 ● no change since last check | 14 ● no change since last check |
|---|
| Trust Flow (Majestic) | 17 | 5 |
|---|
| Citation Flow (Majestic) | 39 | 24 |
|---|
| Referring domains (Majestic) | 493 | 24 |
|---|
Joshua Rogers
depproof