Continuous DevSecOps — scan on every push.
Connect your source once. Every git push runs Aria's SAST, SCA, secret, SBOM, IaC and container checks; findings are auto-mapped to OWASP · CERT-In · DPDP · RBI · SEBI · IRDAI, and routed to AI agents that open auto-fix PRs. No pasting code into textareas.
AppSec posture · no repository connected
Open findings · live
Regulator coverage · India
🧪Static Analysis (SAST)
Aria pattern-based rules + AI rules on every push. SQL injection, XSS, command-injection, crypto weakness, deserialisation, SSRF, path traversal — flagged with auto-fix suggestions and blocking PR gate.
Findings · no repository selected
| Severity | Finding | File | Compliance | Action |
|---|
✨ AI auto-fix preview
Aria reads each finding's call-graph, generates a typed patch, opens a PR with unit-test coverage & compliance annotation. Developer merges.
- cur.execute("SELECT * FROM users WHERE id=" + uid) + cur.execute("SELECT * FROM users WHERE id=%s", (uid,))
CWE-89 · SQLi · adds test_sqli_param_binding📜Dependency Scanning (SCA)
OSV + NVD + GitHub Advisory lookups across npm, pip, maven, go, cargo, rubygems. Critical CVE SLA 72h. License-violation blocks build. Auto-PR for patch-available upgrades.
Vulnerable packages
| Severity | Package | Installed → Fixed | CVE · Compliance | Action |
|---|
📋SBOM Generator
CycloneDX 1.5 / SPDX 2.3 inventory attached to every release. Stored 7 years. Queryable when the next Log4Shell drops. Required by US EO 14028 and incoming CERT-In mandate.
Recent SBOMs
| Artifact | Release | Format | Components | Attestation | Action |
|---|
🔒Secrets Scanner
Pre-receive git hook blocks 200+ secret patterns + entropy. Full history walk on first connect. AWS / GitHub / Stripe / Slack tokens auto-revoked via vendor APIs. Rotation SLA < 4h for anything that slipped.
Detected secrets (across git history)
| Severity | Type | Location | Status | Action |
|---|
🏗Infrastructure-as-Code
Aria policy checks run on every Terraform / Helm / Dockerfile PR. Block merge on CRIT. Per-cloud rule-pack. Exception workflow with auto-expiring waivers.
Misconfigurations
| Severity | Finding | File · Resource | Compliance | Action |
|---|
📦Container Analyzer
Aria layer-by-layer image checks. Dockerfile best-practices. Digest-pinning verified. Runs on every image tag push to GHCR / ECR / GAR / ACR. Admission-controller blocks unsigned images at deploy.
Image vulnerabilities
| Severity | Issue | Image · Layer | Compliance | Action |
|---|
🗺Production Source-Map Exposure
Crawls the prod frontend and fails the build if .map files are reachable. Source maps leak unminified code + internal API paths.
🗺 Run a live scan
Enter a production URL. Aria crawls it, resolves every script/stylesheet's
sourceMappingURL, and checks whether the .map is
publicly reachable — plus a quick secret-pattern scan on any map body it can
fetch. Auto-rotate / webpack patch-PR generation is on the near-term roadmap;
this is the real detection half of that loop today, not a mockup.
📎Document-Metadata Scrubber
Strips PDF / Office metadata that leaks author usernames, internal paths, software versions, GPS coords on publish.
📎 Scan a file
Upload a PDF or Office document. Aria reads its embedded metadata, flags anything that leaks (author, internal path, software version, GPS), and hands back a cleaned copy. Per-channel auto-publish hooks (CMS, e-sign, HR portals) are wired customer-by-customer and are on the roadmap — this single-file scrub-and-clean loop is real today.
📊AppSec Posture
Live rollup of what Aria's scanners actually run and what they've actually found — no seeded numbers. DAST and RASP are on the roadmap and labeled as such below.
⚙ Live Engine Status LIVE
Computed on every load from the actual scanner registry — each row reports whether the semantic engine (real CLI binary) or Aria's built-in regex fallback is active right now.
🔁 Remediation Campaigns LIVE
Open findings from your connected repos, grouped by CWE/rule into batch-fix PR plans — real data from /findings, not a mockup.
🗺 What's live vs. planned
| Capability | Status | Notes |
|---|---|---|
| SAST | LIVE | see the Static Analysis tab · semantic engine when semgrep is deployed, regex fallback otherwise (see Live Engine Status above) |
| SCA | LIVE | OSV.dev — see the Dependency Scanning tab |
| Secrets | LIVE | pattern + entropy detectors with FP classifier — see the Secrets Scanner tab |
| IaC | LIVE | see the Infrastructure-as-Code tab |
| Container | LIVE | CVE scan + hardening advisor — see the Container Analyzer tab |
| SBOM | LIVE | CycloneDX generation — see the SBOM Generator tab |
| API spec analysis | LIVE | OWASP API Top-10 from an OpenAPI spec — see the API Security tab |
| Source-map / doc-metadata exposure | LIVE | see those two tabs |
| DAST (dynamic/black-box) | PLANNED | needs a staging target + auth-cookie replay wiring — not built |
| RASP (runtime self-defense) | PLANNED | needs an in-process runtime agent — not built, no vendor integration exists |
🔌API Security
Paste an OpenAPI 3.x spec — Aria flags OWASP API Top-10 risks visible from the schema alone: missing auth, unbounded params, wildcard CORS, BOLA-shaped unscoped ID params. Runtime traffic analysis (schema drift, live abuse detection, SSRF/IMDS enforcement) needs production traffic capture we don't yet ingest — that's roadmap, marked below.
🔌 Spec analysis LIVE
🗺 Runtime API security — planned
| Capability | Status | What it needs |
|---|---|---|
| Shadow / zombie endpoint detection | PLANNED | production traffic capture vs. spec diff |
| BOLA/IDOR runtime detection | PLANNED | cross-identity object-access pattern on live traffic |
| Rate-limit + abuse triggers | PLANNED | per-key/IP/endpoint quota enforcement at the gateway |
| SSRF → IMDS hardening audit | PLANNED | cloud-account introspection (SCP/NACL/IMDSv2 checks) |
📦Supply Chain Integrity
Real OpenSSF Scorecard lookups + the CycloneDX SBOM generator already live on this page. Signing/SLSA/OIDC/typosquat enforcement needs CI and cloud-account integration we haven't built yet — marked below, not simulated.
🛡 OpenSSF Scorecard lookup LIVE
Live call to api.securityscorecards.dev (OpenSSF's public project) — real third-party signal, not Aria-computed, wrapped in the shared retry/circuit-breaker layer.
📋 SBOM generation LIVE
CycloneDX bill-of-materials generation is already live on this page.
🗺 Build-pipeline integrity — planned
| Capability | Status | What it needs |
|---|---|---|
| AI-BOM (models/weights/datasets) | PLANNED | model-registry integration + picklescan CI gate |
| Signed commits + signed releases | PLANNED | sigstore/cosign wiring into your CI, per-pipeline |
| CI/CD OIDC-only audit | PLANNED | cloud IAM introspection to confirm no static creds remain |
| Dependency pinning + typosquat scan | PLANNED | lockfile-verify CI gate + package-name similarity scan on install |