Dependency-Track
Connect Dependency-Track to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Dependency-Track to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.
| Category | Vulnerability Scanning |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Dependency-Track's guide | docs.dependencytrack.org |
Connect with an API token
-
In Dependency-Track:
- In Dependency-Track, create a team for Safeguard. Creating a team does not create an API key by default.
- Give the team only the permissions VIEW_PORTFOLIO (read projects, services, tags, vulnerabilities, BOMs, Dependency Graph, metrics; use Search) and VIEW_VULNERABILITY (read analysis decisions and findings).
- Generate an API key for the team. A popup window displays the key; copy it now, because from version 4.13 keys are stored hashed and are invisible after creation.
Where to find the other values:
- API URL: The backend (API server) address, not the frontend: http://{hostname}:{port}. With the default Docker Compose file the API server is on port 8081, not 8080.
Dependency-Track shows the secret only once, so copy it before you leave the page.
Dependency-Track's public documentation does not cover every step.
The fetched Dependency-Track pages describe teams, permissions and the API key popup but do not give the menu path or button labels for creating a team or key, so those clicks are not sourced. A team may have multiple keys.
Source: docs.dependencytrack.org, docs.dependencytrack.org, checked 2026-10-07.
The permissions Safeguard needs:
VIEW_PORTFOLIO,VIEW_VULNERABILITY. -
On Compliance › Connectors, open Dependency-Track, click Connect, choose API token and fill in:
Field What to enter API URL Required. Your own server: an https address reachable from the internet. API key Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Dependency-Track and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.1 | 4 |
| ISO/IEC 27001 | Automated tests | A.8.8 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1) | 4 |
| PCI DSS | Automated tests | 6.3.3, 11.3.1 | 4 |
| NIST CSF 2.0 | Automated tests | ID.RA-01, ID.RA-06 | 4 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vulnerability Scanning connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks