Your repositories read as an application security engineer would read them, with fixes raised as pull requests that match how your team already writes.
The ones that matter are buried, and fixing them means an engineer finding time between features.
The IT Operations Engine reads the repository itself, produces findings with the evidence and the attack path attached, and raises the fix as a pull request in the style of the codebase.
What makes a finding worth reading
The engine clones the repository and assesses it as an application security engineer would, then raises the fix as a pull request written to match the patterns already in the repository. We run this on our own platform. Every incident on it becomes a pull request that our engineers review and merge.
Want the findings report for one repository?
Read-only to start. The first pull request follows once you have seen it.
The findings report is the first deliverable. Nothing is raised against your codebase until you have read it.
The engine clones a single repository and assesses it across dependencies, secrets, authentication and authorisation, injection paths, cryptography, CI/CD configuration, containers and infrastructure code.
Each finding carries the affected paths, the evidence, the impact, an attack scenario, a recommendation and a validation step, so it can be checked rather than taken on trust.
Once you have seen the report, fixes are raised as pull requests written to match the patterns already in the repository. Every one is reviewed by an engineer before it merges.
Your standards for what is acceptable stay yours.
You gain:
FAQ
GitHub, GitLab and Bitbucket.
No. Every change is a pull request you can decline.