Skip to main content
This is the official documentation website for safedep.io. Here you will find everything you need to know about using SafeDep’s open source tools and SafeDep Cloud to safeguard your applications against open source software supply chain risks.

​
Why Open Source Security Matters

Did you know? It has been estimated that Free and Open Source Software (FOSS) constitutes 70-90% of any given piece of modern software solutions.
With this level of dependency on open source, security teams need automated tools to safely consume OSS components without slowing down development velocity.

​
Open Source First

SafeDep is built on the belief that security tools should be free, transparent, and accessible to everyone. Our core mission is to provide the security community with powerful open source tools that protect applications from supply chain threats. Our Open Source Tools:
  • vet - Supply chain security analysis for CI/CD pipelines
  • pmg - Protect developers from malicious open source packages
  • xBom - SBOM enriched with AI, Crypto and other metadata using static code analysis
These tools are completely free and built in public with community involvement. They operate independently and can be used without any commercial relationship with SafeDep.

​
How SafeDep Works

SafeDep continuously scans open source packages for malicious code using a combination of static and dynamic analysis. Suspicious packages are verified by security experts to confirm malicious behavior. Both our open source tools and SafeDep Cloud leverage this malicious package detection capability to provide comprehensive protection against open source software supply chain risks.
The diagram below shows how SafeDep works to protect your open source software supply chain against malicious packages.

​
What’s Next?

github-app

Install SafeDep GitHub App

Protect your GitHub repositories against malicious open source packages
vet-cta

Quick Start with vet

Start identifying OSS risks using our free, open-source tool
integration-cta

Integration Guides

Integrate with GitHub, GitLab, and other CI/CD platforms
community

Join Community

Connect with other security engineers and get support