Setup a Fresh DevGuard Instance and Scan for Vulnerabilities#

Set up a local DevGuard instance#

First, clone the devguard-docker-deployment repo, run the guided setup, and start DevGuard:

The guided setup writes .env and generates the encryption key, the Kratos config, and the database init script, then the services are started in the background.

Verify it worked: DevGuard services should start without errors. The web frontend will be available at http://localhost:3000, the API at http://localhost:8080, and Kratos (authorization server) at http://localhost:4433.

Create your account#

Navigate to the registration page at http://localhost:3000/registration and create a new user account:

1. Enter any email address (you won't need to verify it for local instances)
2. Choose a secure password
3. Click the Sign up button

Verify it worked: You should land on the Welcome to DevGuard page. A step-by-step getting started flow guides you from an empty instance to your first repository in four steps: create your organization, create a group, create a repository and integrate DevGuard.

Create your organization#

Your organization holds all groups, repositories and members of your company:

1. Enter a name for your organization (for example, "MyOrg")
2. Click the Create Organization button

If a colleague already invited you, click Join Organization instead.

Verify it worked: The getting started flow marks the organization as done and moves on to step 2.

Create a group#

Groups organize your software projects, for example one group per product. You can split a group further into subgroups, e.g. for the frontend and the backend.

1. Enter a name for your group
2. Add a description (optional)
3. Click Create

You can create as many groups as you need and change these values later. Learn more about how organizations, groups and repositories relate in DevGuard's Key Concepts.

Create a repository#

A repository is a software project you would like to manage the risks of:

1. Keep Create new Repository selected (choose Create new Subgroup if you want to split a bigger project first)
2. Enter a name for your repository
3. Add a description (optional)
4. Select the repository provider you are using: GitHub, GitLab or None. The provider preselects the matching CI/CD setup in the next step. It is optional, so you can use DevGuard without connecting a GitHub or GitLab repository.
5. Click Create

Verify it worked: You should be redirected to the onboarding page of your newly created repository.

Choose how to integrate DevGuard#

The repository onboarding page offers three ways to get your first results into DevGuard:

• CI/CD setup: a guided setup that scans on every push. Choose your build platform (GitHub Actions or GitLab CI/CD), select the scans, add the DevGuard token as a CI/CD secret, copy the generated pipeline, connect your issue tracker and add the webhook.
• Already have a report? Upload an existing CycloneDX SBOM, SARIF report or VEX document. DevGuard detects the file type automatically.
• Other ways to get started: set up the DevGuard CLI, the DevGuard API or integrations and connectors such as Kubernetes.

Hosted CI runners on GitHub or GitLab can't reach a DevGuard instance running on localhost, so this tutorial uses the DevGuard CLI from your machine. Once DevGuard runs on a reachable URL, follow the CI/CD setup or the guides for GitHub Actions and GitLab CI.

Create a DevGuard token#

The scanner needs a token to upload results to DevGuard. In the CI/CD setup on the onboarding page:

1. Click Continue until you reach Add the DevGuard token
2. Click Generate token
3. Copy the token and keep it somewhere safe - it is only shown once

The generated token has the scan scope. Alternatively, create a personal access token in your user settings under Access tokens.

Run the DevGuard scanner#

Pull the DevGuard scanner Docker image:

Navigate to the directory containing the code you want to scan and run the scanner. Replace the --assetName with the path of your repository (<organization>/projects/<group>/assets/<repository>, as shown in the URL of the onboarding page) and --token with your token:

The scanner analyzes your dependencies and identifies known vulnerabilities.

Example output:

Verify it worked: The terminal output should display a table of found vulnerabilities with their risk scores and CVSS ratings.

View scan results in the web interface#

Return to the onboarding page and click Reload page, or use the link printed in the terminal output.

The repository now shows the scan results under Dependency Risks, including the detected vulnerabilities, their risk scores and the affected dependencies.

Explore DevGuard features#

Congratulations! You've successfully set up a DevGuard instance, created an organization structure, and performed your first vulnerability scan.

Take some time to explore additional features:

• Open individual vulnerabilities to understand their risk and remediation options
• Check the Overview of your repository for its security posture over time
• Explore how DevGuard assesses and prioritizes risks