l3montree-dev/devguard

View on GitHub

DevGuard Backend - Secure your Software Supply Chain - Attestation-based compliance as Code, manage your CVEs seamlessly, Integrate your Vulnerability Scanners, Security Framework Documentation made easy - OWASP Incubating Project

Stars: 161
Forks: 43
Open beginner issues: 0
Indexed issues: 135
Avg merge: 1d 8h
Merged PRs (30d): 37

Dominant language: Go
License: No license data
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 18, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue

Beginner friendly Everything

Open All

135 open issues indexed

Dependency proxy: PyPI simple index is passed through unrewritten, so pip cannot download in an egress-restricted network Open

bug component/devguard-api

Difficulty 3/5 1-2 days Newbie friendliness 76/100

l3montree-dev/devguard#3067 · 1 comment · Opened Sep 18, 2026
GHSA-m37j-52j7-pjw7 found in golang/oras.land/oras-go/v2@v2.6.1 Open

cvss-severity:high devguard l3montree-cybersecurity/...ard-k8s-image-inventory pkg:devguard/l3montree-c...ard-k8s-image-inventory pkg:oci/devguard-k8s-ima...ch=amd64&tag=main-amd64 pkg:oci/devguard-k8s-ima...ch=arm64&tag=main-arm64 risk:medium source state:open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

l3montree-dev/devguard#3066 · 1 comment · Opened Sep 18, 2026
GHSA-m37j-52j7-pjw7 found in golang/oras.land/oras-go/v2@v2.6.0 Open

cvss-severity:high devguard l3montree-cybersecurity/...ard-k8s-image-inventory pkg:oci/devguard-k8s-ima...ch=amd64&tag=main-amd64 pkg:oci/devguard-k8s-ima...ch=arm64&tag=main-arm64 risk:medium state:open

Difficulty 4/5 3-5 days Newbie friendliness 52/100

l3montree-dev/devguard#3065 · 1 comment · Opened Sep 18, 2026
Package Inspector: crates.io lookups return no results (tokio, tracing); C++ also affected Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 45/100

l3montree-dev/devguard#3064 · Opened Sep 18, 2026
Extend E2E Tests for Compliance Postures Flow Open

component/devguard-web feature-request

l3montree-dev/devguard#3057 · 1 assignee · Opened Sep 17, 2026
Current main seems to force huge postgresql mem spikes Open

component/devguard-api needs more info

Difficulty 5/5 Over a week Newbie friendliness 25/100

l3montree-dev/devguard#3055 · Opened Sep 16, 2026
The images on the GitHub integration tutorial don't load Open

bug

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

l3montree-dev/devguard#3049 · Opened Sep 15, 2026
Automatic Vexing of Withdrawn Vulnerabilities Open

component/devguard-api component/devguard-web feature-request

Difficulty 5/5 Over a week Newbie friendliness 35/100

l3montree-dev/devguard#3045 · Opened Sep 14, 2026
DevGuard should support CycloneDX Version 1.7 Open

component/devguard-api component/devguard-scanner priority:high

Difficulty 3/5 1-2 days Newbie friendliness 68/100

l3montree-dev/devguard#3044 · Opened Sep 14, 2026
The risk history overview should always reflect only the data status where data is available for all artifacts Open

bug component/devguard-api component/devguard-web priority:high

Difficulty 4/5 3-5 days Newbie friendliness 52/100

l3montree-dev/devguard#3043 · Opened Sep 14, 2026
Reopen vex rules are recommended if they are created by the organization Open

bug component/devguard-api

Difficulty 4/5 3-5 days Newbie friendliness 35/100

l3montree-dev/devguard#3042 · Opened Sep 14, 2026
OIDC provider template drops `claims_source` (generic providers against Okta/Entra get no email claim) Open

component/devguard-helm-chart

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

l3montree-dev/devguard#3039 · Opened Sep 14, 2026
Project members can't see any of the project's repositories (member role is never linked to asset read) Open

feature-request

Difficulty 4/5 3-5 days Newbie friendliness 68/100

l3montree-dev/devguard#3038 · Opened Sep 14, 2026
`PDF_GENERATION_API` is hardcoded to a l3montree cloud endpoint; `INSTANCE_DOMAIN` falls back to the in-cluster URL when the API ingress is disabled Open

component/devguard-helm-chart

l3montree-dev/devguard#3040 · 1 assignee · Opened Sep 14, 2026
Support an external PostgreSQL (bundled postgresql cannot be disabled, host is hardcoded) Open

component/devguard-helm-chart

l3montree-dev/devguard#3041 · 1 assignee · Opened Sep 14, 2026
Adjust AssetVersion and Artifact Identifier columns Open

component/devguard-api feature-request priority:low

Difficulty 4/5 3-5 days Newbie friendliness 45/100

l3montree-dev/devguard#3037 · Opened Sep 12, 2026
Data Transfer from SaaS Environment to a selfhosted DevGuard Instance Open

component/devguard-api priority:high

Difficulty 5/5 Over a week Newbie friendliness 35/100

l3montree-dev/devguard#3036 · Opened Sep 11, 2026
SCA scan fails with 500er - DB Deadlock Open

bug component/devguard-api needs more info

Difficulty 4/5 3-5 days Newbie friendliness 35/100

l3montree-dev/devguard#3034 · Opened Sep 10, 2026
Improve web react context architecture by using 19.3 feature Open

component/devguard-web

Difficulty 3/5 1-2 days Newbie friendliness 68/100

l3montree-dev/devguard#3032 · Opened Sep 10, 2026
Proposal: Improve Merkle-Tree Database Layout Open

component/devguard-api feature-request

Difficulty 5/5 Over a week Newbie friendliness 38/100

l3montree-dev/devguard#3025 · Opened Sep 8, 2026
VulnDB Documentation page updaten - link to the blog post Open

component/devguard-documentation

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

l3montree-dev/devguard#3024 · 1 comment · Opened Sep 7, 2026
Wrong dependency proxy URLs on app.devguard.org Open

bug component/devguard-api component/devguard-web priority:high

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

l3montree-dev/devguard#3022 · Opened Sep 5, 2026
Strange behavior of Risk counter and Badges Open

bug component/devguard-api

Difficulty 3/5 1-2 days Newbie friendliness 48/100

l3montree-dev/devguard#3011 · Opened Sep 2, 2026
DevGuard opens linked GitLab issues multiple times Open

bug component/devguard-api

Difficulty 3/5 1-2 days Newbie friendliness 50/100

l3montree-dev/devguard#3010 · Opened Sep 2, 2026
dependency proxy error Open

component/devguard-api

Difficulty 3/5 1-2 days Newbie friendliness 48/100

l3montree-dev/devguard#3008 · Opened Sep 2, 2026
GHSA-vp52-pcj8-j9qc found in golang/google.golang.org/grpc@v1.80.0 Open

cvss-severity:high devguard l3montree-cybersecurity/...ard-k8s-image-inventory pkg:oci/devguard-k8s-ima...ch=amd64&tag=main-amd64 pkg:oci/devguard-k8s-ima...ch=arm64&tag=main-arm64 risk:low state:open

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

l3montree-dev/devguard#3007 · 1 comment · Opened Sep 2, 2026
Evaluate the cpe field of CycloneDX components during vulnerability matching Open

feature-request

l3montree-dev/devguard#3006 · 4 comments · 1 assignee · Opened Sep 1, 2026
Dependency Graph is having huge performance issue Open

bug component/devguard-web

Difficulty 4/5 3-5 days Newbie friendliness 35/100

l3montree-dev/devguard#2940 · Opened Aug 31, 2026
Checkboxes on dependency risks behaviour is wrong Open

component/devguard-web

l3montree-dev/devguard#2927 · 1 assignee · Opened Aug 26, 2026
Explain the Roles in DevGuard Open

component/devguard-documentation

Difficulty 1/5 1-3 hours Newbie friendliness 85/100

l3montree-dev/devguard#2926 · Opened Aug 26, 2026
Go pseudo-version causes false positives for patched Prometheus releases Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

l3montree-dev/devguard#2922 · 1 comment · Opened Aug 26, 2026
Devguard does not support SBOM without BomRef Open

bug component/devguard-api

Difficulty 3/5 1-2 days Newbie friendliness 68/100

l3montree-dev/devguard#2918 · 3 comments · Opened Aug 25, 2026
Dependency Risks: Export Table Open

feature-request

Difficulty 3/5 1-2 days Newbie friendliness 55/100

l3montree-dev/devguard#2914 · Opened Aug 25, 2026
Dependency Risks: show CVE instead of GHSA Open

feature-request

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

l3montree-dev/devguard#2913 · Opened Aug 25, 2026
Searching for CVE does not return result if CVE is an alias Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 62/100

l3montree-dev/devguard#2912 · Opened Aug 25, 2026
Replace unbounded IN/Create calls with parameter-safe patterns Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

l3montree-dev/devguard#2911 · Opened Aug 25, 2026
Leader election delays vulndb import and prevents getting results in freshly installed instance Open

component/devguard-api

l3montree-dev/devguard#2899 · 1 assignee · Opened Aug 21, 2026
DevGuard Web enable eslint enforcement in pipeline Open

component/devguard-web

l3montree-dev/devguard#2887 · 1 assignee · Opened Aug 19, 2026
Watchlist Service for VulnDB - Visitors Open

component/devguard-documentation feature-request

Difficulty 5/5 Over a week Newbie friendliness 30/100

l3montree-dev/devguard#2884 · Opened Aug 19, 2026
Display of Dependency Proxy Data in the overview Tab Open

component/devguard-api component/devguard-web feature-request

Difficulty 5/5 Over a week Newbie friendliness 30/100

l3montree-dev/devguard#2858 · Opened Aug 14, 2026
Improve Telemetry Data captured via Umami Open

component/devguard-web priority:high

Difficulty 4/5 3-5 days Newbie friendliness 38/100

l3montree-dev/devguard#2845 · Opened Aug 12, 2026
Fingerprinting in IaC scan doesnt seem to work Open

component/devguard-api priority:high

Difficulty 3/5 1-2 days Newbie friendliness 55/100

l3montree-dev/devguard#2839 · 2 comments · Opened Aug 12, 2026
Raised DB error level with insert or update on table "assets" violates foreign key constraint "fk_projects_assets" Open

bug component/devguard-api

l3montree-dev/devguard#2834 · 3 comments · 1 assignee · Opened Aug 11, 2026
Make CVE (`vulnerabilities`) in scanned SBOMs available inside DevGuard Open

feature-request

Difficulty 3/5 1-2 days Newbie friendliness 55/100

l3montree-dev/devguard#2829 · 2 comments · Opened Aug 11, 2026
Adjusting the CTA on the Vulnerability Database (Website) Open

good first issue

l3montree-dev/devguard#2828 · 1 assignee · Opened Aug 11, 2026
View the DevGuard prioritization is shown in DevGuard itself + option to adjust the protection level via a dropdown menu Open

component/devguard-documentation feature-request

Difficulty 4/5 3-5 days Newbie friendliness 48/100

l3montree-dev/devguard#2827 · Opened Aug 11, 2026
Making Vex Rules for Vulnerabilities publicy availiable in Vulnerability database Open

component/devguard-api component/devguard-documentation feature-request

Difficulty 3/5 1-2 days Newbie friendliness 65/100

l3montree-dev/devguard#2826 · Opened Aug 11, 2026
Init vulns from nearest git ancestor branch, not latest event Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

l3montree-dev/devguard#2796 · 1 comment · Opened Aug 5, 2026
Canonical VEX information Open

feature-request

Difficulty 4/5 3-5 days Newbie friendliness 45/100

l3montree-dev/devguard#2790 · Opened Aug 5, 2026
Implement SBOM Merkle tree for minimal storage requirement of component dependencies table Open

feature-request

Difficulty 5/5 Over a week Newbie friendliness 38/100

l3montree-dev/devguard#2780 · 2 comments · Opened Aug 4, 2026

l3montree-dev/devguard

Get new issues in your inbox