It runs on your runner. Not on ours.

The scan happens inside your pipeline and returns SARIF, so findings land in the tools your engineers already have open and your source never has to leave the build.

GitHub Actions

Add one step to your workflow and every pull request gets a compliance scan. Findings upload to …

2 steps to set up

Azure Pipelines

Install the Marketplace task, add ScrutoraScan@1 to your pipeline, and findings render on a buil…

3 steps to set up

VS Code

Scan the open workspace and see compliance findings inline in the Problems panel, before you pus…

3 steps to set up

GitLab CI/CD

Add the CI/CD Catalog component to your pipeline and every merge request gets an offline complia…

2 steps to set up

CircleCI

Add the certified orb, call the scan job with your frameworks, and gate builds on compliance fin…

2 steps to set up

Bitbucket Pipelines

Reference the pipe in bitbucket-pipelines.yml, no plugin to install. It runs an offline complian…

2 steps to set up

Google Cloud Build

Cloud Build runs the scanner image directly as a build step, no plugin, no Docker-in-Docker, and…

2 steps to set up

01 · The same everywhere

One container, whatever your CI is called.

NO API KEY FOR CI

Scanning in a pipeline is free and needs no account. The gate works before anyone has decided to buy anything.

SARIF 2.1.0

Findings appear as annotations on the pull request that introduced them, next to the diff, while the author still has context.

WORKS OFFLINE

The scan runs entirely inside the step, so restricted build pools with no outbound access are fine.

02 · Try itPUBLIC REPOSITORIES

Add it to a pipeline.

A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.