Lightweight, free, open — where open-source security starts
Built for OSPOs, individual developers, small teams, and security, legal, and compliance roles — a systematic approach to open-source component management.
Covers the full lifecycle of introduce, detect, fix, and manage — open source without losing control.
Integrated component analysis quickly inventories your project's open-source dependencies and versions into a clear ledger.
Outputs SBOMs in standard formats to meet pre-delivery compliance — especially for finance, healthcare, and other regulated buyers.
Identifies open-source license types and potential conflicts, giving early warning of compliance and IP risk.
Opens the CLI and partial module source for scripted integration and custom workflows.
Embeds detection into the pipeline for a closed loop of commit → auto-scan → alert → fix-verify.
Register online and start — no complex deployment, a low-barrier first line for small teams.
From individual developers to compliance firms — something for each.
Self-check when adding open-source dependencies — enjoy open source without losing control.
Build allowlists and pre-delivery full scans, moving from passive detection to active defense.
Stand up a first gate for open-source governance with a lightweight tool, accruing composition and compliance ledgers.
Pinpoint license conflicts and pair SBOM as structured evidence for due diligence and legal defense.
CE is the starting point. When you need snippet-level identification, multi-source vuln intel, container scanning, and enterprise policy governance, upgrade smoothly to CleanSource SCA Enterprise.
Yes. Free upon registration, with 20 scans per week and a 500MB per-scan limit — built for individual developers, OSPOs and small teams.
Community covers component identification, vulnerability detection, license analysis and SBOM export. Enterprise adds snippet-level scanning, on-premises deployment, policy management, multi-source vulnerability intelligence and expert services.
Upload source code or scan via CLI; a component inventory and risk report are generated automatically — export your first standard SBOM in minutes.
The CLI and selected modules are open-sourced on GitHub (github.com/sectrend-cn). Community contributions are welcome.
The Community Edition is SaaS: uploaded code is used only for that scan. If code must never leave your network, choose the Enterprise Edition's on-premises deployment.
The component and vulnerability knowledge base shares the same foundation (CVE, CNVD, CNNVD and other public sources); Enterprise adds CSSA proprietary early intelligence with multi-source triage for earlier alerts.
The upgrade path is smooth — the Sectrend team assists with configuration migration, unlocking snippet-level scanning, on-premises deployment and policy management.
Register the Community Edition and generate your first SBOM and open-source risk report in minutes.
