Failure PatternDecision layer
The DepWarden Free-Tier Trap: Why Agencies Stall on 100 Scans a Month
Symptom: Agency reports to a client are delayed because the free tier's 3-project limit forces repeated project swapping and re-scans. Root cause: DepWarden's free tier caps scans at 100 per month and projects at 3, which is fine for a demo but collapses under a single active client with multiple repositories.
By InnovaAI ResearchPublished
Symptoms
- •Agency reports to a client are delayed because the free tier's 3-project limit forces repeated project swapping and re-scans.
- •A developer hits the 100 scans/month ceiling mid-sprint and cannot run a security check before a client release.
- •Client asks for a PDF or Excel report, but the free tier only outputs HTML, so the agency manually reformats findings.
- •Agency promises SAST coverage in a proposal, then discovers static analysis is gated behind the $99 Team plan.
- •Scan results miss typosquatting on Maven packages because the agency never verified which ecosystems the free tier actually covers.
Root Causes
- •DepWarden's free tier caps scans at 100 per month and projects at 3, which is fine for a demo but collapses under a single active client with multiple repositories.
- •Report format limits on the free tier (HTML only) push agencies into manual workarounds instead of upgrading to Team at $99/mo for PDF, Excel, and CSV exports.
- •SAST is a paid feature that only appears on Team and Business plans, so agencies that quote a security audit without checking plan features underdeliver on static analysis.
- •The tool's documentation does not list white-label options, so agencies cannot rebrand client-facing reports and end up exposing DepWarden's name in deliverables.
Fast Fixes
- •In the DepWarden dashboard, review the current scan count and project list under the plan usage meter, then move active client repos to a paid plan before the monthly reset.
- •Upgrade to the Team plan ($99/mo) to enable PDF, Excel, and CSV report exports, and set up automated report delivery to clients via the API.
- •Configure build gating in the CI/CD pipeline using severity thresholds so that critical vulnerabilities block builds, reducing the need for manual scan triggers.
- •Audit which ecosystems each client project uses and confirm DepWarden's coverage (npm, PyPI, Maven, OSV.dev) matches the client's stack before promising typosquatting detection.