OWASP Dependency-Track
Track software components and vulnerabilities from CycloneDX bills of materials.
What’s included for free?
The self-hosted platform is ongoing-free under Apache-2.0 with no vendor component quota; operators supply data sources and infrastructure.
Where it runs: Self-hosted
Provider information ↗Checked 2026-11-01
Before you use it
Apache-2.0 covers Dependency-Track. Vulnerability feeds, SBOM generators and integrations have separate terms.
Provider terms can change. Check current pricing and usage rights before starting a project.