DeployHub Ortelius

DeployHub Ortelius is an open-source vulnerability detection platform incubating at the Continuous Delivery Foundation. The platform provides centralized vulnerability management for open-source packages from code to cloud environments.

Ortelius aggregates Software Bill of Materials (SBOMs) from CI/CD pipelines to create application-level visibility into open-source components. The platform monitors OSV.dev in real-time and provides daily CVE alerts for continuous vulnerability tracking. It integrates OpenSSF Scorecard insights to assess the security posture of open-source packages used across applications.

The platform maps open-source vulnerabilities to active deployment endpoints, enabling teams to identify where vulnerable packages are running in production. Users can search for specific packages across all endpoints to determine exposure and impact. Ortelius maintains an inventory of components with unlimited security tracking capabilities.

The free SaaS version supports small teams and open-source projects with vulnerability aggregation, consolidated SBOMs, and security postures for one logical application. It includes unlimited component security tracking, user-level access controls, and CI/CD integration capabilities through a command-line interface.

DeployHub offers a commercial version with additional features including support for multiple applications, agentless deployments, organizational domains, LDAP and Active Directory integration, and technical support during standard hours.