CodeSec
Continuous application security for GitHub & GitLab
Connect a repository once. CodeSec runs SAST, secret detection, dependency, container, IaC, Kubernetes and CI/CD analysis on every push and pull request — then deduplicates the findings, scores the project and gates the change before it merges. Built by the team whose security checklists and incident write-ups you may already be reading.
Six analysis engines, one deduplicated report
| Layer | Engine | What it catches |
|---|---|---|
| Secrets | gitleaks | Leaked keys and tokens — in the working tree and the full git history |
| Code (SAST) | semgrep | Vulnerable patterns across 15+ languages |
| Dependencies & containers | trivy | CVEs in packages and OS layers, plus licence issues |
| Infrastructure as code | checkov | Terraform, CloudFormation, Kubernetes and Helm misconfigurations |
| Dockerfiles | hadolint | Image-build antipatterns before they ship |
| CI/CD & pipelines | CodeSec native rules | The layer most tools skip — see below |
Every finding gets a category-aware fingerprint: the same vulnerability across ten scans is one row with its own triage history — a shifted line number or a reformatted file does not resurrect it, and a scanner that failed to run can never mark anything as fixed.
The pipeline attacks most scanners ignore
Supply-chain attacks increasingly enter through the pipeline itself, not the code. CodeSec ships its own rule set for the layer generic scanners skip:
- Unpinned actions — third-party steps referenced by tag instead of commit SHA
- pull_request_target checking out untrusted code — the classic workflow privilege-escalation
- Script injection through expressions like
${{ github.event.issue.title }} - Excessive GITHUB_TOKEN permissions, artifact poisoning paths, privileged runners
Score the project, gate the change
Security Score
Deduplicated findings roll up into a per-project score — a number a team can own, track and be measured on, instead of an ever-scrolling list.
Security Gate
Policy decides what blocks a merge; the verdict lands as a PR check on the pull request, where developers actually work.
Triage That Sticks
Accept a risk or mark a false positive once — the fingerprint keeps the decision attached through rescans, rebases and refactors.
Roles That Match Reality
Owner, Admin, Security, Developer, Viewer — security teams triage, developers connect and scan, auditors read. Multi-tenant by construction: every query is organization-scoped, and the test suite proves it.
Hostile input assumed
A security tool that executes the code it scans is an attack surface. CodeSec never runs repository code: no build, no dependency install, no git hooks, no submodules, no symlink following. Each scanner runs in its own container as an unprivileged user with CPU, memory and output limits, mounts the checkout read-only, holds no credentials and has no database access — and only the CVE-database refresh has network egress at all. The clone happens once, centrally; scanners fan out against it in parallel.
SaaS or your own infrastructure
| Option | Best for | Notes |
|---|---|---|
| SaaS — codesec.grafclouds.com | Fastest start; sign in with GitHub or GitLab | Operated by us; no public inbound ports on the backend (Cloudflare Tunnel) |
| Self-hosted | Code-sovereignty and compliance requirements | Docker Compose stack on your infrastructure — your code never leaves your network |
- Connect once: GitHub and GitLab sign-in and repository integration; scans trigger on push and pull request.
- Air-gap friendly: the only egress is the CVE-database refresh, and even that can be disabled.
- Ecosystem fit: AiMon watches your infrastructure, DNS Wall guards your network, CodeSec secures your code and pipelines — same team, one family.
Frequently asked questions
How is CodeSec different from running semgrep and trivy in CI myself?
The engines are the start, not the product. CodeSec adds category-aware deduplication (one vulnerability = one row with triage history), a project score, a policy-driven merge gate, CI/CD-security rules the generic tools skip, partial-result correctness and multi-tenant RBAC — the operational layer that turns scanner output into a workflow.
Does CodeSec execute or build my code?
Never. No build, no dependency install, no hooks, no submodules. Scanners read the checkout read-only inside resource-limited, credential-free containers.
Which platforms and languages are covered?
GitHub and GitLab repositories; SAST across 15+ languages via semgrep, plus secrets, dependency/container CVEs, Terraform/CloudFormation/Kubernetes/Helm, Dockerfiles and CI/CD workflows.
What does it cost?
Per-organization pricing scoped to repository count and deployment model — contact us for a demo, trial access or a self-hosted quote.
See your own repository scored
Sign in with GitHub, connect one repository and get a deduplicated, scored report on the first scan — or book 30 minutes and we'll walk your pipeline's attack surface with you.
Open CodeSec Book a demo