Tools for a secure software lifecycle.
Dependably builds tools for the points in a software lifecycle where a quiet failure becomes an incident: what enters a build, what a release ships, and what is running for your users. Each one is open source under Apache-2.0 and runs on your own infrastructure, and Dependably Packages is also available as Dependably Cloud, a paid plan we operate.
Common failures across the software lifecycle.
The marked points are where they act; the failures beside the loop link to the solution for each.
- Plan
The reasons behind a design live in a thread that is now closed.
A decision is made in a review or a call and the code carries only the outcome. With sdd, design intent lives in a spec repository that is validated in CI and retrievable by the people and agents doing the next change.
Read the solution → - Code
An internal package name is resolvable upstream.
If a private name is not reserved, a public package of the same name can win resolution and land in your build. Dependably Packages can reserve your namespaces so they are never resolved upstream, and pin each name to the registry that first served it.
Read the solution → - Build
Every language gates the merge differently.
Each linter and audit has its own configuration, severity scale, and idea of a finding, so nothing is comparable and the warnings pile up. The Dependably check tools read one configuration and emit one finding format: dependency checks from the lockfile, lint and metrics without a build.
Read the solution → - Build
A package you already trust ships a compromised release.
A stolen publish token puts a malicious patch version under a real maintainer's name, and it runs on your CI runner with your CI credentials. Dependably Packages can hold new releases for a set period, refuse packages that ship install scripts, and block on malicious-package advisories.
Read the solution → - Test
An advisory lands and nobody knows which services ship it.
The scanner lists every occurrence as if each one were exploitable, and nobody can say which release of which service carries the affected version. Projects in Dependably Packages keep a bill of materials per release and order each advisory by whether your code can reach it.
Read the solution → - Release
Nobody can say which build pulled which version.
After an incident the question is which pipeline fetched an artefact, when, and under whose token. A public registry does not keep that record for you. Dependably Packages records every fetch and every policy decision in its own audit log.
Read the solution → - Operate
Advisories are published after a version is already cached.
A version that was clean when you first installed it can have an advisory published months later. Nothing re-reads a lockfile, so the build stays green. Dependably Packages rescans versions already in the cache on a schedule and gates on the result.
Read the solution → - Operate
A certificate expires without anyone noticing.
The renewal job broke weeks earlier and failed quietly, and the expiry is the first visible symptom. Dependably StatusCheck tracks the days remaining on every endpoint you list and warns while there is still time to renew.
Read the solution → - Monitor
Your users find out before you do.
During an incident people need somewhere to look, and a load balancer reporting healthy is not that place. Dependably StatusCheck probes your endpoints on a schedule and publishes a status page you post updates to.
Read the solution →
Every package your builds pull, served from inside your perimeter.
Dependably Packages sits between your builds and the public registries. It proxies and caches npm, PyPI, Maven, NuGet, Cargo, Go, RPM, Alpine apk, OCI images, Terraform providers, and Hex packages, and hosts your own packages on the same coordinates for most of them. Go, apk, and Terraform are mirrors only. Everything is checked against your policy before it is served.
- Policy gates on licence, OSV severity, CISA KEV, EPSS probability, install scripts, and minimum release age.
- Publisher-signature verification can be enabled for seven artefact classes: npm, PyPI, NuGet, Maven, RPM, Alpine, and Terraform.
- Periodic rescans of versions already in the cache, so advisories published after a version landed still surface.
- Every cached artefact is content-addressed by a checksum and, where the upstream publishes a digest, checked against it; a mismatch is an auditable failure. Go modules are verified by the go client against the checksum database, and apk packages are recorded on first fetch.
- An audit log of every fetch, policy decision, and token event, forwardable to a SIEM as NDJSON over a webhook, or CEF or RFC5424 over syslog.
Every certificate and endpoint you operate, watched from outside your network.
Dependably StatusCheck inventories the public-facing assets you operate and checks them from the outside, the way your users reach them. It tracks how long every certificate has left, probes whether your endpoints are answering, and publishes a status page you control.
- Certificate expiry tracking, with a warning threshold you set; an alert fires as the date approaches.
- Scheduled uptime probes over HTTP, TCP, and ICMP, with retries before anything is declared down.
- Maintenance windows excluded from the uptime figure.
- Alerts over Slack, PagerDuty, or a webhook.