Developer Security Suite
Continuous scan · LIVE
Online

Continuous DevSecOps — every push, eleven scanners.

Connect your source once. Every git push fans out to 11 scanners; findings are auto-mapped to OWASP · CERT-In · DPDP · RBI · SEBI · IRDAI, and routed to AI agents that open auto-fix PRs. No pasting code into textareas.

Auto-scan ON · 3 repos · last 2m ago
GitLab · Bitbucket · Aria Agent · ZIP upload
In private beta. For early access, email dayananda@anthrotech.in.

AppSec posture · acme/platform

A–
87 / 100
87
▲ +4 vs last week
OWASP Top-10 coverage 10/10 · CWE Top-25 23/25

Open findings · live

3
Critical
12
High
48
Medium
94
Low
17
Info
14 days agoToday · ▼ 38% MoM

Regulator coverage · India

CERT-In 6-hr100%
DPDP Act95%
RBI Cyber100%
SEBI CSCRF92%
IRDAI 48h100%
OWASP Top-1010/10
🧪 SAST3
📜 Dependency SCA5
SBOM
🔒 Secrets2
🏗 IaC4
📦 Containers7
🗺 Source-Maps3
📎 Doc Metadata
Posture
🔌 API Security6
Supply Chain

🧪Static Analysis (SAST)

Semgrep rule-pack + Aria AI rules on every push. SQL injection, XSS, command-injection, crypto weakness, deserialisation, SSRF, path traversal — flagged with auto-fix suggestions and blocking PR gate.

Scans last 7d
214
auto · on push
Blocked merges
11
crit/high gate
Mean time to fix
38h
target < 72h
AI auto-PR rate
64%
merged as-is

Findings · acme/platform@main

last scan 2m ago · commit a7f2c91
SeverityFindingFileComplianceAction

✨ AI auto-fix preview

Aria reads each finding's call-graph, generates a typed patch, opens a PR with unit-test coverage & compliance annotation. Developer merges.

PR #482 · auto-open
- cur.execute("SELECT * FROM users WHERE id=" + uid)
+ cur.execute("SELECT * FROM users WHERE id=%s", (uid,))
covers CWE-89 · SQLi · adds test_sqli_param_binding
📝 Run a one-off manual scan (paste code)▸

📜Dependency Scanning (SCA)

OSV + NVD + GitHub Advisory lookups across npm, pip, maven, go, cargo, rubygems. Critical CVE SLA 72h. License-violation blocks build. Auto-PR for patch-available upgrades.

Packages tracked
4,218
direct + transitive
Open CVEs
17
3 critical
Auto-PRs (30d)
412
Dependabot-style
License flags
2
AGPL · GPL-3

Vulnerable packages

OSV pulled 12m ago · next sync in 48m
SeverityPackageInstalled → FixedCVE · ComplianceAction
📝 Run a one-off manual scan (paste manifest)▸

📋SBOM Generator

CycloneDX 1.5 / SPDX 2.3 inventory attached to every release. Stored 7 years. Queryable when the next Log4Shell drops. Required by US EO 14028 and incoming CERT-In mandate.

SBOM per release
100%
CycloneDX attached
Components tracked
3,258
842 direct · 2,416 trans.
License coverage
99.2%
3 unknown · flagged
Sigstore signed
100%
keyless attestation

Recent SBOMs

latest v4.12.1 · 842 direct components
ArtifactReleaseFormatComponentsAttestationAction
📝 Generate SBOM from a pasted manifest▸

🔒Secrets Scanner

Pre-receive git hook blocks 200+ secret patterns + entropy. Full history walk on first connect. AWS / GitHub / Stripe / Slack tokens auto-revoked via vendor APIs. Rotation SLA < 4h for anything that slipped.

Repo coverage
100%
312 / 312 repos
Blocks (pre-commit)
142
last 30d
Slipped through
2
in rotation window
Mean rotation SLA
3h 12m
target < 4h

Detected secrets (across git history)

scan depth all commits · reach-back 2yr
SeverityTypeLocationStatusAction
📝 Scan pasted code / config▸

🏗Infrastructure-as-Code

Checkov · tfsec · kube-linter · KICS run on every Terraform / Helm / Dockerfile / Pulumi PR. Block merge on CRIT. Per-cloud rule-pack. Exception workflow with auto-expiring waivers.

IaC repos scanned
42
tf · helm · docker
CRIT blocked (30d)
13
merge refused
Active waivers
3
expire in < 30d
CIS benchmark
98%
AWS · GCP · Azure

Misconfigurations

terraform + helm + dockerfile · PR gate ENFORCED
SeverityFindingFile · ResourceComplianceAction
📝 Scan pasted Terraform / Dockerfile / K8s YAML▸

📦Container Analyzer

Trivy + Grype layer-by-layer scan. Dockerfile best-practices. Digest-pinning verified. Runs on every image tag push to GHCR / ECR / GAR / ACR. Admission-controller blocks unsigned images at deploy.

Images scanned
212
by digest
CRIT vulns
7
in base layers
Admission blocks (7d)
4
unsigned · rejected
Distroless / chainguard
86%
of production

Image vulnerabilities

across 212 images · last sync 8m ago
SeverityIssueImage · LayerComplianceAction
📝 Scan pasted Dockerfile▸

🗺Production Source-Map Exposure

Crawls the prod frontend and fails the build if .map files are reachable. Source maps leak unminified code + internal API paths.

Source map exposure scanner — available in our Q3 release

We're holding this scanner back until it can do the full closed loop: crawl your production frontend, harvest secrets and internal API paths from any reachable .map file, and auto-rotate or open a webpack patch PR. Shipping just a half-loop scanner would fail the ChatGPT Test — that's a 20-line script anyone can write.

For early access ahead of Q3, email dayananda@anthrotech.in — we are onboarding a small number of design partners for this shield.

📎Document-Metadata Scrubber

Strips PDF / Office metadata that leaks author usernames, internal paths, software versions, GPS coords on publish.

Release metadata scrubber — available in our Q3 release

The scrubber depends on per-channel publish hooks (Marketing CMS, Sales enablement, Legal e-sign, HR portals) that we are wiring customer-by-customer rather than shipping a generic ExifTool wrapper. A button that runs ExifTool on a one-off upload would fail the ChatGPT Test.

For early access ahead of Q3, email dayananda@anthrotech.in — we are onboarding a small number of design partners for this shield.

📊AppSec Posture

The exec scorecard — rolls up SAST · SCA · Secrets · DAST · RASP into a single organisation grade. Mapped to OWASP ASVS, NIST SSDF, and CERT-In guidelines. Trend vs last quarter.

📊 Org-wide Summary LAYER 4

Repos with SAST gate
100%
block-on-high
Mean SAST-fix time
38h
target < 72h
Dependabot auto-PRs
412
last 30d
Open critical CVEs
3
SLA 72h
Push-protection hits
42
secrets caught pre-commit
RASP protected apps
5 / 5
critical

🧪 SAST — every repo, every PR (T120)

Semgrep rule-pack. Block merge on HIGH. Author-assigned fixes. Tracks mean-time-to-fix per severity.

RepoRuns/weekFindings (30d)MTTFBlock rate
acme/platform214HIGH 2 · MED 1422h100%
acme/api186HIGH 0 · MED 8—100%
acme/billing94HIGH 1 · MED 1241h100%
acme/mobile62HIGH 0 · MED 4—100%
acme/infra (tf)38HIGH 3 · MED 2254h100%

📜 SCA — CVE · License · EOL (T121)

Snyk / OSV / Trivy daily pull. Auto-PR for patch-available. Critical CVE SLA 72h. License-violation blocks build.

FindingPackageRepoSeverityAction
CVE-2026-1841libxml2 2.9.14platformCRITpatch PR opened
CVE-2026-2018axios 0.21.4apiHIGHupgrade 1.6.x
License violationsharp-gplmobileAGPLremove · use sharp
EOL upstreampython 3.8etlEOLupgrade to 3.12
CVE-2025-52812golang 1.21.4infraCRITauto-PR in review

🔒 Secret-Scan Push-Protection (T122)

Pre-receive hook blocks secret patterns on every repo org-wide. Rotation SLA < 4h on any leak that slipped through.

Repo coveragePatternsBlocks (30d)SlippedRotation SLA
312 / 312 (100%)142 (git-versioned)42 pre-commit43h 12m mean

🎯 DAST — Nightly on staging (T123)

ZAP / Burp-Enterprise with auth-cookie replay. Diff vs prior night. Feeds triage queue.

TargetLast runFindings (diff)Auth replayState
stage.[your-org].com04:18 today+2 HIGH · +6 MED✓TRIAGE
stage-api.[your-org].com04:22 today0 new✓CLEAN
stage-billing.[your-org].com04:26 today+1 HIGH (IDOR)✓P0

🛡 RASP — Runtime App Self-Defense (T128)

Blocks exploit-attempt patterns in real time on top-5 critical apps. Telemetry streams to secops data lake.

AppRASP agentBlocks (7d)KindPerf overhead
payments-apiContrast18SQLi · SSRF · CMD-inj3.2%
billing-webContrast4deserialization attempt2.8%
auth-svcContrast12path-traversal · SSRF3.1%
kyc-uploadContrast6XXE attempt2.9%
admin-consoleContrast2JWT tamper3.0%

🔌API Security

Runtime traffic vs OpenAPI spec. OWASP API Top-10 coverage. Shadow / zombie endpoint detection, BOLA · IDOR scoring, rate-limit drift, SSRF → IMDS hardening, auth-scope audit.

🔌 API Overview LAYER 4

APIs discovered
287
from prod traffic
Schema drift
18
undocumented
Shadow / zombie
6
no owner
IDOR/BOLA signals
3
investigating
Rate-limit triggers
118
24h
IMDS hardening
100%
IMDSv2 required

🔎 API Discovery + Schema Drift (T124)

Compare prod traffic to OpenAPI spec. Undocumented endpoints get an owner assignment within the sprint.

EndpointMethodTraffic (7d)In spec?OwnerState
/api/v1/billing/invoice/:idGET42k✓billing-engOK
/api/v1/internal/debug/dumpPOST120✗—ZOMBIE · REMOVE
/api/v2/kyc/documents/:uuidGET12k✓kyc-teamOK
/api/v1/admin/user/:id/impersonatePOST6spec missingplatformDOCUMENT + AUTHZ
/healthzGET4.2M✓platformOK

🎯 BOLA / IDOR Detector (T125)

Identity-A accessing Identity-B's object pattern on the API wire. Per-endpoint authorization pattern check.

EndpointPatternScoreAction
/api/v1/invoice/:iduser_42 reading user_99's invoices91block + open ticket
/api/v1/users/:id/profilemass enumeration /1..999988rate-limit + auth-check
/api/v2/support/tickets/:idcross-tenant guess62investigate

⏲ API Rate-Limit + Abuse-Prevention (T126)

Per-key · per-IP · per-endpoint quotas. Anomaly detect on new-client-suddenly-noisy.

EndpointQuotaTriggers (24h)Top offenderAction
/auth/login5 / 10s / IP84185.22.x.x · AS45090block 24h
/api/v1/search60 / min / key12key pk_live_…8b429 returned
/api/v1/export10 / min / user4internal analytics429 + owner notify
/api/v2/bulk2 / sec / org18vendor integrationupgrade path emailed

🔐 SSRF → IMDS Block (T127)

Egress from workload reachable only to allow-listed. IMDSv2 required. Hop-count and 169.254.169.254 hard-blocked from application VPCs.

ControlStatusCoverageLast verified
IMDSv2 required (hop-limit 1)ENFORCED100% of EC2today
Metadata endpoint blocked from app VPCsENFORCEDSCP + NACLtoday
Outbound URL fetcher allow-listENFORCED74 FQDNstoday
Kubernetes metadata API firewalledENFORCEDall clusterstoday
SSRF fuzz · quarterly drillPASS5 apps14d ago

📦Supply Chain Integrity

SLSA L3 provenance, sigstore signatures, dependency pinning, typosquat detection, AI-BOM for every model. The build pipeline itself is a control-point — SolarWinds · Codecov · xz-utils would not have shipped.

📦 Supply-Chain Overview LAYER 4

SBOM per release
100%
CycloneDX attached
AI models signed
14 / 14
hash-pinned
Signed commits
98%
of merges last 30d
SLSA level
L3
on core pipelines
Pickle loads
0
safetensors only
Dep pinning
100%
lockfile verify

📋 SBOM per Build (T129)

CycloneDX / SPDX attached to every release artifact. Stored 7y. Queryable when the next log4j drops.

ArtifactReleaseFormatComponentsAttestation
platform-apiv4.12.1CycloneDX 1.5842 direct · 2,416 transitivesigstore · attached
billing-webv2.18.0CycloneDX 1.5312 direct · 1,108 transitivesigstore · attached
mobile-iosv8.4.0SPDX 2.3214 direct · 488 transitiveApp-Store-Connect
mobile-androidv8.4.0SPDX 2.3186 direct · 612 transitivePlay-console

🤖 AI-BOM — Models · Weights · Datasets (T130)

Every model in production has owner + source + SHA-256 + eval-report. Pickle is blocked — safetensors only. Picklescan CI gate.

ModelSourceFormatSHA-256EvalStatus
aria-triage-v3internal · fine-tunesafetensorsa1e0…c7✓ passedPROD
llama-3.1-70b-instructhf/meta-llamasafetensors33f7…21✓ passedPROD
all-MiniLM-L6-v2hf/sentence-transformerssafetensors8b32…e0✓ passedPROD
guard-pi-v2Lakerasafetensors (SaaS)remote✓ passedPROD
shady-huggingface-dlhf/unknownpickle (.bin)——BLOCKED · picklescan

✍ Signed Commits + Signed Releases (T131)

Sigstore / cosign. Build artifacts signed. Verify at deploy. SLSA L3 provenance attestation on core pipelines.

Repo / pipelineSigningSLSALast artifactVerify at deploy
acme/platformsigstore · keylessL3v4.12.1 · today✓ required
acme/apisigstore · keylessL3v3.08.0 · yday✓ required
acme/billingcosign · kms-keyL3v2.18.0 · today✓ required
acme/mobileApple · Googlen/av8.4.0 · 6h✓ store-enforced
acme/docs-sitegh-pages · unsignedL1—info-only

🎫 CI/CD OIDC-Only (T132)

GitHub / GitLab → Cloud via OIDC. No long-lived cloud creds in runners. Remaining static creds audited with a kill-date.

PipelineTarget cloudAuth methodStatic credsKill-date
platform-ciAWS prodOIDC · sts:AssumeRoleWithWebIdentity0✓ migrated
api-ciGCP prodWorkload Identity Federation0✓ migrated
billing-ciAWS prodOIDC0✓ migrated
mobile-ciApp Store ConnectJWT (short-lived)0n/a
legacy-etlAWS stagingstatic key130 Apr 2026
vendor-syncAzure storageSAS token · 90d115 May 2026

📌 Dependency Pinning + Lockfile Verify (T133)

Fail-build on unpinned. Renovatebot for controlled upgrades. Typosquat-name scan on every install.

EcosystemReposPinned + lock-verifiedTyposquat hits (30d)Status
npm / pnpm142100%2 (reactt, lodahs) · blockedCLEAN
pip / poetry68100%1 (beautifulsoup) · blockedCLEAN
go modules42100%0CLEAN
cargo14100%0CLEAN
maven888%02 SNAPSHOT deps
container images212100% by digest1 (nginxproxy) · blockedCLEAN