SupplyGuard is a local, security-focused Software Supply Chain Vulnerability Scanner designed to identify security risks hidden within third-party and open-source dependencies.
Modern applications rarely consist entirely of code written by their developers. They rely on hundreds of external libraries, frameworks, and packages. A single vulnerable dependency can become an entry point for attackers and compromise an otherwise secure application.
SupplyGuard helps developers discover those risks before they reach production.
Modern software is built on a massive ecosystem of open-source dependencies. A typical application may depend on:
This creates a large and often difficult-to-track software supply chain. If one dependency contains a known vulnerability, attackers may be able to exploit the vulnerable component through the application that uses it.
SupplyGuard provides a centralized way to:
- Discover project dependencies
- Map dependency relationships
- Identify known vulnerabilities
- Detect associated security advisories
- Prioritize security risks
- Identify available remediation versions
- Visualize the project's dependency security posture
SupplyGuard integrates pip-audit to identify known vulnerabilities affecting Python dependencies and pipdeptree to analyze dependency relationships and expose the structure of the software dependency tree.
DASHBOARD
DEPENDENCY SCANNER
VULNERABILITY FINDINGS
RISK DISTRIBUTION
sudo apt update sudo apt install -y python3 python3-venv python3-pip cd supplyguard python3 -m venv .venv source .venv/bin/activate pip install -r requirements.txt python app.py
Open http://127.0.0.1:5000.
Upload a project's requirements.txt. The dashboard reports dependency count, known vulnerabilities, severity, advisory IDs, fixes, and an inventory.
Browser → Flask → pip-audit / pipdeptree → JSON → dashboard
This MVP is intentionally local and API-key-free. A future version can add Snyk/Dependabot integrations, SBOM generation, npm support, scan history, authentication, and exportable reports.