Low Severity
Published: Nov 6, 2026
Self-hosted dependency vulnerability monitor and CI/CD gate with email and Telegram alerts
# DepRadar
Self-hosted dependency vulnerability monitoring and CI/CD gating for every project an agency
maintains.
DepRadar is implemented across a FastAPI backend and Next.js interface: project and inventory
monitoring, isolated OSV scans, finding workflow, SMTP/Telegram delivery, quiet hours and
per-project alert thresholds, EPSS/KEV enrichment, delivery attempt history, service health,
retention, and verified backup/restore. Pipelines integrate through scoped API tokens, a
standard-library client, a GitHub Action, and a GitLab template: default-branch pipelines keep
monitored inventories current, and pull/merge request pipelines are gated without touching
monitored state. Owner-defined, versioned central policies set a minimum that pipelines cannot
relax; every gate decision is recorded with its evidence; and GitHub/GitLab jobs can authenticate
with their OIDC identity instead of a stored secret, with pull/merge request runs limited to
check-only access. One owner account administers the installation; team accounts are not built yet.
Uploading an inventory records what was submitted; rechecking it does not refresh source code or
prove deployed state.
## Screenshots
Captured from a demo installation with fictional client projects, real OSV-Scanner results, and
live CISA KEV and FIRST EPSS data.
| Findings across every project | Finding detail with KEV, EPSS, and the fixed version |
| --- | --- |
|  |  |
| **Project detail** | **Alert channels and policy** |
| ![Project drawer with open findings, manifests, and highest-priority it