For software owners
You paid for it. You own it. You cannot read it.
If consultants, an outsourcing partner or a supplier build your systems, you own that code — and the only report on its quality comes from the people who wrote it. Watchdog measures it independently, on a schedule, and hands you the number and the evidence behind it.
Sign in with GitHub · no card · the first full report on any repository is €0.
The problem
The supplier grades their own homework.
This is not an accusation of bad faith. It is a structural gap: nobody else is looking, and the questions that matter are not answerable from a demo.
Is it maintainable by anyone else?
Bus factor, knowledge concentration, coupling and dead code decide whether you can change supplier, or are quietly locked in.
Is it secure, and can you show it?
Dependency CVEs, secrets in the git history, container and IaC posture — and a conformance read against NIS2, the Cyber Resilience Act, DORA and seven more frameworks.
Is it getting better or worse?
One reproducible score per sprint, so quality is a trend line in your supplier reviews instead of an argument.
What you get
Four reports, on your cadence, without touching their pipeline.
Watchdog runs on a schedule on our hardware — not inside your supplier's CI/CD. It cannot slow their builds, it cannot block a release, and it does not need their permission to be useful to you.
Executive
The score, the posture, and what it means — for the people who decide and pay.
Engineering
The findings, prioritised — hand it straight to the supplier as the work list.
Security
The posture against OWASP Top 10, CWE Top 25, PCI-DSS and OWASP ASVS.
Audit
The acceptance verdict, the exact rubric and commit measured, and what changed since last time. This is the one that carries the signed record.
The method is published and the score recomputes from the evidence, so your supplier can check it too — and argue with a rule rather than with you.
Which product is yours
The rule is ownership, not authorship. If you own the source code, Watchdog is the product — whoever actually writes it. If you are judging software somebody else owns, such as a packaged system you are buying or a company you are acquiring, that is Assay. Many organisations need both: Watchdog for the systems built for them, Assay for the software they buy.
Measure what you are paying for.
The first full report on any repository is €0 — you will see your own result before anything is billed.