Low Severity
Published: Nov 5, 2026
Self-hosted dependency vulnerability monitor and CI/CD gate with email and Telegram alerts
# DepRadar
Self-hosted dependency vulnerability monitoring and CI/CD gating for every project an agency
maintains.
DepRadar is implemented across a FastAPI backend and Next.js interface: project and inventory
monitoring, isolated OSV scans, finding workflow, SMTP/Telegram delivery, quiet hours and
per-project alert thresholds, EPSS/KEV enrichment, delivery attempt history, service health,
retention, and verified backup/restore. Pipelines integrate through scoped API tokens, a
standard-library client, a GitHub Action, and a GitLab template: default-branch pipelines keep
monitored inventories current, and pull/merge request pipelines are gated without touching
monitored state. One owner account administers the installation; team accounts are not built yet.
Uploading an inventory records what was submitted; rechecking it does not refresh source code or
prove deployed state.
## Screenshots
Captured from a demo installation with fictional client projects, real OSV-Scanner results, and
live CISA KEV and FIRST EPSS data.
| Findings across every project | Finding detail with fix versions and EPSS |
| --- | --- |
|  |  |
| **Project detail** | **Alert channels and policy** |
|  |  |
## Deploy on a server
One command takes a fresh Linux VPS or machine to a running HTTPS dashboard with an owner account
and daily verified backups:
```sh
sudo git clone https://git