Question 1

How do I prioritise vulnerabilities?

Accepted Answer

Metaport exposes every application's packaged dependencies and pre-sorts them according to exposure to CVEs and GitHub advisories.Metaport accounts for KEV, EPSS, and CVSS data in its default Prioritisation Score and supports more mature teams who want to configure their own scoring calculations.

Question 2

How do I prioritise EOL software?

Accepted Answer

Unlike security vulnerabilities — the most urgent of which should be patched as soon as possible — EOL software should be judged according to the risk appetite of your customers and stakeholders.A great way to kick off those decisions is by sharing the website and application lifecycle Gantt chart with them, and planning upgrades and CAPEX spending sooner rather than later.

Question 3

How does reporting work?

Accepted Answer

Executives get a bird's-eye view of the maintenance standing of their entire portfolio and operation with the Executive Health Report.Download an example here.Teams will be more familiar with the information, guidance, and recommendations provided by individual Application Health Reports.

Question 4

What can I search for in my customers' apps?

Accepted Answer

Surface projects by CVE, end-of-life criticality, dependency name, or version.Your team may have noticed a CVE affecting one project, but how do you know which others are also affected?Using Metaport, your team can surface projects against lists of CVEs — useful when speed is key during an incident — as well as software and infrastructure components approaching end of life.

Question 5

Why Metaport?

Accepted Answer

Software spends 70% of its lifetime in maintenance mode.But without the right information, delivery teams waste time hunting for EOL dates and security information for planning and budgeting.Metaport surfaces that data automatically and early, so teams get ahead of problems instead of reacting to them.

Question 6

Who's it for?

Accepted Answer

Digital agency and government teams.Traditional AppSec tooling is intended for AppSec people, but Metaport is different — it's for your whole team. Making security, planning, and engineering information available to everyone means your team has no blind spots. Everyone sees what everyone else sees.

Question 7

How do I see what's end-of-life (EOL)?

Accepted Answer

Metaport's website and application lifecycle chart and shared maintenance calendar give teams a clear picture of what's nearing EOL and when.When it's shared with customers and stakeholders, everyone's on the same page.You can also check isitendoflife.com to quickly look up EOL dates for specific technologies like Django, Drupal, or Laravel for example.

Question 8

Where does the data come from?

Accepted Answer

Metaport's catalogues are refreshed automatically as new and updated EOL components, EPSS data, and KEV records become available. When your websites and applications report to Metaport, their findings are kept current too.Metaport can receive data from your production applications in two ways: through an agent, or through CI/CD by connecting to your team's existing VCS and AppSec tools.

Question 9

Is it like Dependabot?

Accepted Answer

No. But it does integrate with it. Dependabot raises pull requests for outdated dependencies, but it doesn't track end-of-life and it only works with GitHub.Metaport works across any tech stack and any VCS. It's focused on giving your team early visibility of EOL risk so you can plan upgrades with customers well in advance — rather than just flagging individual dependency issues.

Question 10

Which integrations are available?

Accepted Answer

Metaport currently integrates with DependencyTrack, Dependabot, Jira, and Keycloak.Because the core is open source, developers can build additional integrations without much friction.

Question 11

So is it just another AppSec or ASPM tool?

Accepted Answer

No, not really. Most AppSec tools focus on individual repositories, container images, or codebases — and they're designed for technical users.Metaport gives your whole team a portfolio-wide view across all your clients' applications, and it's designed for everyone, not just engineers and security teams.

Question 12

Is my stack supported?

Accepted Answer

Probably! Metaport is technology agnostic so it works with any modern web application stack.Data can be ingested from your Terraform or Helm IaC files via GitHub or GitLab, or from our native agents which are available for Node, PHP, Python, and .NET.

Question 13

Is Metaport open source?

Accepted Answer

Yes.Metaport CE is available from our GitLab, with base Docker images also available from our Docker Hub.Metaport SaaS is open core, meaning it's built on the open-source foundation provided by Metaport CE.

Question 14

Does it help with compliance?

Accepted Answer

Yes.Keeping software up to date and avoiding end-of-life components is a key part of staying compliant, and it's central to Metaport's design.Metaport gives teams portfolio-wide visibility to surface risk and plan remediation across all their clients, reducing operational risk before it becomes a compliance issue.

Question 15

How much does it cost?

Accepted Answer

Check the pricing section for available subscription tiers. Plans are structured around per-application and per-user limits.Metaport is also open source, so you can self-host it. Managed support packages are available.Contact us for more details.

Question 16

Is Metaport multi-tenant?

Accepted Answer

Yes.Metaport operates through organisational units (OUs), labelled "Organization" in the product. Each OU acts as an umbrella for applications, users, teams, and encryption keys.

Question 17

How do we get started?

Accepted Answer

Pick a plan in the pricing section and hit "Start free". Or head straight to the docs site to set up Metaport CE yourself.While you're at it, take the survey and tell us what you think.

Security Policy

Reporting security issues

Security Policy

Reporting security issues

Cookies