Difference between revisions of "OWASP Dependency Track Project"

Jump to: navigation, search
Line 46: Line 46:
Coming soon.
<gallery widths="300px">
<gallery widths="300px">
File:Dependency-Track-login-screenshot.png|Login screen
File:Dependency-Track-login-screenshot.png|Login screen

Revision as of 13:40, 22 August 2013


OWASP Dependency-Track

OWASP Dependency-Track is a Java web application that allows organizations to document the use of third-party components across multiple applications and versions.


Over the last several years, organizations have faced a growing trend on the number of vulnerabilities reported due to the use of vulnerable third-party components. The risk involved in using third-party components is described in a paper by Jeff Williams and Arshan Dabirsiaghi titled, "The Unfortunate Reality of Insecure Libraries". This upward trend propelled the use of third-party components into a new category in the OWASP Top Ten, specifically, A9: Using Components with Known Vulnerabilities.

Library Management

Dependency-Track's first goal is to document the use of third-party components across multiple applications and versions. Organizations can document the usage of components including vendors, libraries, versions and licenses. Many organizations have legal or new product introduction requirements that require software engineering teams to provide documentation on the use of third-party components. Dependency-Track aims to meet this requirement.

Vulnerability Management

Coming soon...


OWASP Dependency-Track can be used to:

  • Hierarchical view of applications and associated versions
  • Document vendors, libraries, versions, and licenses
  • Document dependencies between applications and libraries
  • Provides cross-reference capabilities
  • ...more coming soon...


Coming soon.


Coming soon.


Coming soon.

As of July 2013, the priorities are:

  • Complete the initial release of Dependency-Track and publish binary and github source repository details
  • Integrate Dependency-Check into Dependency-Track
  • Create dashboard providing at-a-glace visibility into the use of vulnerable components
  • Auto-populate Dependency-Track database with library identification from Dependency-Check
  • Create scheduler to start Dependency-Check scans
  • Update Dependency-Check to use Dependency-Track metadata as the sole source of evidence
  • Translate into other languages
  • Promote use of Dependency-Track

Involvement in the development and promotion of Dependency-Track is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:


Are you fluent in another language? Can you help translate Dependency-Track into that language?

Front-End Gurus

What to provide design or an implementation for a way to visualize data? There's a lot of potential opportunities in this area. Let us know if you can help.


Please use the Dependency-Track mailing list for feedback:

  • What you like?
  • What you don't like?
  • What could be improved?

What does this OWASP project offer you?
What releases are available for this project?
what is this project?
Name: OWASP Dependency Track Project (home page)
Purpose: Dependency-Track is a Java web application that allows organizations to document the use of third-party components across multiple applications and versions.
License: GNU GPL v3 License (allows commercial use, but requires that modifications to your code stay open source, thus prohibiting proprietary forks of your project)
who is working on this project?
Project Leader(s):
  • Steve Springett @
Project Contributor(s):
  • Nikhil Chitlur Navakiran
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
  • Contact Steve Springett @ to contribute to this project
  • Contact Steve Springett @ to review or sponsor this project
  • Contact the GPC to report a problem or concern about this project or to update information.
current release
Source code available on GitHub
last reviewed release
Not Yet Reviewed

other releases