Question 1

How do I prioritize vulnerabilities?

Accepted Answer

Metaport exposes every application's packaged dependencies and pre-sorts them according to exposure to CVEs and GitHub advisories.Metaport accounts for KEV, EPSS, and CVSS data in its default Prioritization Score and supports more mature teams who want to configure their own scoring calculations.

Question 2

How do I prioritize EOL software?

Accepted Answer

Unlike security vulnerabilities — the most urgent of which should be patched as soon as possible — EOL software should be judged according to the risk appetite of your customers and stakeholders.A great way to kick off those decisions is by sharing the lifecycle Gantt chart with them, and planning upgrades and CAPEX spending sooner rather than later.

Question 3

How does reporting work?

Accepted Answer

Executives get a bird's-eye view of the maintenance standing of their entire portfolio and operation with the Executive Health Report.Download an example here.Teams will be more familiar with the information, guidance, and recommendations provided by individual Application Health Reports.

Question 4

What can I search for in my customer's apps?

Accepted Answer

Surface projects by CVE, end-of-life criticality, and by dependency name or version.Your team may have noticed a CVE affecting one project, but how do you know which others are also affected?Using Metaport, your team surfaces projects against lists of CVEs — useful when speed is key during an incident — as well as soon-to-be-expiring software and infra components.

Question 5

Why Metaport?

Accepted Answer

Software spends 70% of its lifetime in maintenance mode.But without the right information, delivery teams waste time hunting for EOL dates and security information for planning and budgeting.Metaport surfaces that data automatically and early, so teams get ahead of problems instead of reacting to them.

Question 6

Who's it for?

Accepted Answer

Traditional AppSec tooling is intended for AppSec people.Metaport is different — it's for your whole team. Making security, planning, and engineering information available to everyone means your team has no blind spots. Everyone sees what everyone else sees.

Question 7

How do I see what's end-of-life (EOL)?

Accepted Answer

Metaport's lifecycle chart and shared maintenance calendar give teams a clear picture of what's nearing EOL and when.When it's shared with customers and stakeholders, everyone's on the same page.You can also check isitendoflife.com to quickly look up EOL dates for specific technologies like Django, Drupal, or Laravel for example.

Question 8

Where does the data come from?

Accepted Answer

Metaport's catalogs are refreshed automatically: New and updated EOL components, EPSS, and KEV records are continually updated. This means that when your websites and applications report in to Metaport, all findings are also continually updated.There are two ways for Metaport to receive data from your production applications: Agent or CI/CD, by plugging into your team's existing VCS and AppSec tools.

Question 9

Is it like Dependabot?

Accepted Answer

No. But it does integrate with it. Dependabot raises pull requests for outdated dependencies, but it doesn't track end-of-life and it only works with GitHub.Metaport works across any tech stack and any VCS. It's focused on giving your team early visibility of EOL risk so you can plan upgrades with customers well in advance — rather than just flagging individual dependency issues.

Question 10

Which integrations are available?

Accepted Answer

Metaport currently integrates with DependencyTrack, Dependabot, Jira, and Keycloak.Because the core is open source, developers can build additional integrations without much friction.

Question 11

So is it just another AppSec or ASPM tool?

Accepted Answer

No, not really! Most AppSec tools focus on individual repos, container images, or codebases — and they're designed for technical users.Metaport gives your whole team a portfolio-wide view across all your clients' applications, and it's designed for everyone to use; not just engineers and security teams.

Question 12

Is my stack supported?

Accepted Answer

Probably! Metaport is technology agnostic so it works with any modern web application stack.Data can be ingested from GitHub, GitLab, or from native agents which are available for Node, PHP, Python, and .NET.

Question 13

Is Metaport open source?

Accepted Answer

Yes!Metaport CE is available from our GitLab, with base Docker images also available from our Docker Hub.Metaport SaaS is open core, that means it's built on the Open Source foundations provided by Metaport CE.

Question 14

Does it help with compliance?

Accepted Answer

Yes!Keeping software up to date and avoiding end-of-life components is a key part of staying compliant, and it's a key part of Metaport's design.Metaport provides teams with portfolio-wide visibility to surface risk, and plan remediation across all your clients reducing operational risk before it becomes a compliance issue.

Question 15

How much does it cost?

Accepted Answer

Check the pricing section for available subscription tiers. Plans are structured around per-application and per-user limits. Metaport is also open source, so you can self-host it. A managed support package is available at USD $259/month.Contact us for more details.

Question 16

Is Metaport multi-tenant?

Accepted Answer

Yes.Metaport operates on OUs simply named as an "Organization"—an umbrella for apps, users, teams, and encryption keys.

Question 17

How do we get started?

Accepted Answer

Pick a plan in the pricing section and hit Get Started. Or head straight to the docs site to set up Metaport CE yourself.While you're at it, take the survey and tell us what you think.

Metaport Agency Features

Features Built for Maintenance Conversations

Shareable client assets

Portfolio insights

Day-to-day maintenance tools

Enterprise readiness

Next steps