An opinionated scaffolding framework that jumpstarts Java projects with an API-first design, secure defaults, and minimal dependencies

Dependency-Track is an intelligent Supply Chain Component Analysis platform that allows organizations to identify and reduce risk from the use of third-party and open source components.

Frontend UI for Dependency-Track

Template test for demonstrating issues with DataNucleus using the JDO API

Security scanning orchestration and results enrichment framework -- forked and rewritten from @thought-machine/dracon

CycloneDX SBOM Model and Utils for Creating and Validating BOMs

DataNucleus core persistence support - the basis for anything in DataNucleus

Quarkus: Supersonic Subatomic Java.

DataNucleus support for persistence to RDBMS Datastores

A Java library for calculating CVSSv2, CVSSv3, and CVSSv4 scores and vectors

Parallel Apache Kafka client wrapper with per message ACK, client side queueing, a simpler consumer/producer API with key concurrency and extendable non-blocking IO processing.

Java libraries for working with available vulnerability data sources (GitHub Security Advisories, NVD, EPSS, CISA Known Exploited Vulnerabilities, etc.)

CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

A utility for validating and parsing Common Platform Enumeration (CPE) v2.2 and v2.3 as originally defined by MITRE and maintained by NIST

An application observability facade for the most popular observability tools. Think SLF4J, but for observability.

Proof-of-concept for decoupling responsibilities from Dependency-Track's monolithic API server into separate, scalable services, based on Apache Kafka.

An Open Letter to the OWASP Board