Cybersecurity outpost for your repositories.

Connect GitHub, GitLab, and Bitbucket. Once a month, every repository gets one report: known vulnerabilities, committed secrets, dependency risk, static analysis, an AI review, and what changed.

Start monitoring See pricing

Trivy Semgrep Gitleaks CycloneDX Gemini Git history

Connect once. Read the report every month.

The hosts your team already uses. Git Outpost scans on a monthly schedule, and you can run a scan early when a release cannot wait.

Connect the hosts

GitHub, GitLab, and Bitbucket. More than one account on each is fine.

Six checks, every repository

Vulnerabilities, static analysis, secrets, dependencies, an AI review, and a change report.

One place to read them

Every scan writes a report. The findings move. The place you read them does not.

GitHub

Public and private repositories this account can read.

GitLab

Projects on GitLab.com, including the ones in your groups.

Bitbucket

Bitbucket Cloud repositories this account can open.

Reports

Six checks. One report.

A finished scan always leaves a report. Severity tells you which finding to open first.

Vulnerabilities
Known CVEs in containers, filesystems, and dependencies. Found with Trivy.
Static code analysis
Injection, unsafe defaults, and the same class of defect. Found with Semgrep.
Secrets
Credentials and tokens committed to the repository. Stored values are redacted.
Dependencies
A CycloneDX bill of materials, with end-of-life dates and deprecated packages.
AI security review
A written security review. A model’s reading of the repository, not a guarantee.
Change report
What landed since the last report, grouped by the work. No severity on this one.

Teams

The subscription belongs to the organization.

A person can belong to more than one. Repositories, members, and billing stay inside the organization they belong to.

Members and invitations
Invite by email. They accept from a link, with a role already assigned.
Roles
Owner, admin, member, billing, and viewer. One person can hold more than one.
Account security
Verified email, password reset, an authenticator, and sign-in with GitHub, Google, or GitLab.