DerScanner 13 release: Offline SBOM Generation, Repository Manager Analysis, and more

Happy DerScanner 13 day! The latest release focuses on supply chain security in isolated environments, adds SBOM generation from Nexus and JFrog, introduces a new analysis type that blocks risky components before they reach the codebase, and updates SAST compliance mappings to the 2025 standard versions. It also ships an updated interface, JSON report exports, scan tags, and an out-of-the-box Azure Boards integration.

 

Generate SBOMs without Internet access

Every SCA scan starts with an SBOM. Until now, building one meant downloading component data from public package registries, a dependency that fully isolated environments cannot allow. In practice this forced a choice: request a firewall exception for the scanner, or run composition analysis outside the perimeter and carry the results back in.

DerScanner 13 removes that choice. The SBOM Generator pulls components from the organization's own repository manager, Nexus or JFrog, so SCA runs entirely inside the perimeter with no exception requests, no side channels, and no paperwork for the security office.

What this changes in daily work:

• SCA becomes available in networks where it was previously off the table: classified environments, defense, critical infrastructure, banks with strict egress rules.

• The SBOM reflects the components the organization actually builds from, taken from its own repository, rather than whatever a public registry resolves at scan time.

• One isolation story for the whole platform. Teams that chose DerScanner for on-premise SAST no longer treat SCA as the odd module out.

Supported ecosystems: NuGet (C#/VB.NET), Conan (C++), Pub (Dart), ProxyGolang (Go), Gradle and Maven (Java/Kotlin/Scala), npm (JavaScript/TypeScript), Packagist (PHP), PyPI (Python), RubyGems (Ruby), Cargo (Rust), CocoaPods (Swift).

 

Block risky components before they enter the codebase

When a scan finds a vulnerable component, that component is already in the project. Someone imported it, code now depends on it, and removing it means a remediation ticket, a developer's time, a regression test run, and sometimes a release delay. The later a bad component is caught, the more it costs to pull out.

DerScanner 13 moves the check to the earliest possible point with Artifactory Analysis, a new analysis type that inspects the artifact repository itself rather than an individual project. It connects to Nexus or JFrog and detects the same risk classes as SCA: known vulnerabilities, supply chain risks, and license risks. On top of detection, custom security policies block the download of violating components, covering Cargo, CocoaPods, Conan, Gradle, Maven, npm, NuGet, Packagist, ProxyGolang, Pub, PyPI, and RubyGems repositories.

What this changes in daily work:

• The security team sets policy once at the repository level, and it protects every project and every developer that pulls from it. No per-project configuration.

• A component with a critical CVE or a forbidden license never reaches a developer's machine. The download fails at the repository, at the moment of the pull, when swapping it for an alternative costs minutes.

• Fewer remediation tickets downstream. Prevention at the repository shrinks the backlog that SCA scans would otherwise generate later.

 

Map findings to the 2025 standard versions

SAST findings now map to the current editions of the vulnerability classification standards:

• CWE/SANS Top 25 (2025)

• OWASP Top 10 (2025)

• OWASP API Security Top 10 (2023)

Auditors and customers ask for reports against the current standard versions, and reclassifying findings by hand is exactly the kind of work nobody budgets for. With DerScanner 13, findings arrive pre-mapped to the editions in force this year, so audit evidence comes straight from the report.

 

Read source code in CSV

CSV SAST reports now include the source code of each finding. A reviewer triages findings directly in the export, and the report makes sense to a developer or an auditor who has no access to the DerScanner interface.

 

Find scans faster with tags

Projects and scans now support tags. Tag scans by team, release, branch, or audit scope, then filter the list instead of scrolling through hundreds of entries. Pulling every scan relevant to a specific audit takes one filter instead of a search through naming conventions.

 

Create Azure Boards tasks from DerScanner

DerScanner 13 ships an out-of-the-box, API-based integration with Azure Boards. Users create Boards work items directly from the DerScanner interface.

For teams on the Microsoft stack this closes the last manual step between finding and fix: a vulnerability becomes a task in the sprint backlog in one action, with no copy-pasting and no security engineer chasing developers through chat to make sure the finding landed in the tracker.

 

Updated interface

The interface has been refreshed across the platform for clearer navigation and faster access to scan results.

 

DerScanner 13 is available now. To see offline SBOM generation or Artifactory Analysis on live infrastructure, request a demo.