Skip to content
CyberArmorApplication security engineering
Explore the platform
Menu
Explore the platform
São Paulo, Brasil · DevSecOps

We secure the pipeline your clients already ship on.

198 code rules across 14 languages and 31 secret patterns, next to whatever your own scanners produced. Taint tracking runs on JavaScript and TypeScript only, inside a single function, and it ships off by default — that sentence is on this page because you would find it out anyway.

Talk to the engineer
SARIFCYCLONEDXNESSUS XMLCSV

What the engines count

198code rules across 14 languagesTaint on JavaScript and TypeScript only, inside one function, off by default.
8dependency ecosystems, 9 manifests and 12 lock files, with the transitive treeNo operating-system package is read here.
31secret patterns, plus 183 IaC rules and 100 container rulesIn IaC it is 111 AWS rules, 16 Azure, none for Google Cloud.

Every count was read item by item in the engine source, not rounded from a brief.

In your day

The bottleneck is not finding it. It is the last mile.

  • I do not want to swap the tools I already use

    You do not. The platform reads what your tools already output: SARIF (CodeQL, Semgrep, SonarQube), Trivy and Grype, ZAP, Burp, Nuclei, Nessus and OpenVAS, and CSV from Qualys, Rapid7 and Tenable. It all lands in the same findings table as what our own engines found, and on the way back it exports SARIF.

  • I do not want to reopen the same finding at every retest

    A finding identity does not use line numbers, so reformatting a file does not invent a new finding. What you marked as accepted or false positive stays marked on the next scan — and bulk marking refuses to close a critical or high finding.

  • I need it inside the pipeline my client already has

    GitHub, GitLab and Azure DevOps in the cloud, with scan status posted back to the pull request. There is no pipeline Action and no command-line program: the connection is an HTTP call you write.

  • My client is asking for an SBOM

    It generates CycloneDX 1.6 through the official library, built from the dependency set an SCA scan already resolved, and returns the component count and how many carry a known vulnerability. It does not resolve the tree on its own: with no SCA scan first, the request is refused with a 422. An SBOM generated elsewhere can be uploaded and enriched against the same vulnerability database.

Import and identity

What happens to a finding after it arrives

5tool output readers: SARIF, CycloneDX, Nessus XML, DAST and vendor CSVIt works with the set you already have.
1finding with two sources when two scanners see the same flaw — not two findingsDeduplication already included.
0line numbers in a finding identity: reformatting does not reopen what you acceptedA stable result between scans.
Limits

What we do not do

Every limit below was read in the code before it was written here, and it is in writing before the proposal, not after it.

  • Data-flow tracking covers two languages

    Taint runs on JavaScript and TypeScript only, inside a single function, and it is off by default. Elsewhere it is pattern matching, line by line, and one line cannot see the one before it.

  • Three repository providers, in the cloud

    GitHub, GitLab and Azure DevOps. Bitbucket does not connect, self-hosted GitLab does not, GitHub Enterprise Server does not. The hosts are fixed in the code.

  • The web scanner sees the anonymous surface

    It does not log in to your client system, and it does not inspect certificate, cipher or TLS version. When it confirms a flaw it stops there: no privilege escalation, no command execution, no data extraction.

  • The report is a PDF, and it carries our brand

    White label does not exist. Our brand sits in the header and footer of every page, and changing it takes a code change and a rebuild. No Word, no Excel.

  • The platform is not live yet

    Infrastructure is being rebuilt. There is no signup, no trial and no billing, and you pay for nothing before it exists.

Next step

Tell us which scanners you run and we will tell you what lands in the table.

There is no signup and no trial to click. What exists today is a technical conversation with the person who wrote the code.

Talk to the engineer