Secuur / Services / CI-driven scanning
02 · Shift left

Find it at the pull request. Not six months later in a report.

A vulnerability caught in CI costs a developer ten minutes while the code is still in their head. The same vulnerability caught in an annual pen test costs a sprint, a change-approval board and an awkward email to a customer. Secuur runs in your pipeline and fails the build before either happens.

readiness-scan
https://
What it is

CI-driven scanning.

CI-driven scanning is the difference between security as an event and security as a property of your build. Instead of a scheduled assessment that photographs your posture on one arbitrary Tuesday, every commit gets checked against the same rules, and the result lands where developers already work — as a pull-request annotation on the line that caused it.

The hard part is not running a scanner in a pipeline. It is running one that finishes inside a reasonable build budget, that reports the delta rather than the backlog, and that produces so few false positives your team does not learn to ignore it. Those three constraints drive every design decision in how Secuur runs in CI.

What you get

Six things this actually does.

01

Native pipeline integration

GitHub Actions, GitLab CI, Jenkins, CircleCI and Azure Pipelines. A step in your workflow file, an API token, done.

02

Baseline diffing

The gate reports only what this change introduced. Your existing backlog does not block today's deploy.

03

Pull-request annotations

Findings appear inline on the diff with the request and response that proved it, so nobody has to reproduce it from a ticket.

04

Configurable failure policy

Fail on high and critical, warn on medium, ignore informational — per repository, per branch, per environment.

05

Ephemeral-environment support

Point the scan at the preview deployment your PR just created, so you test the change in situ instead of against staging.

06

Budgeted runtime

Time-boxed passes tuned to finish inside your build SLA, with the deep crawl deferred to the nightly automated run.

The Secuur difference

A build gate for your crypto, too

Cryptographic regressions are silent. Someone bumps a base image, the new OpenSSL build drops a key-exchange group, and the endpoint quietly stops negotiating hybrid post-quantum — with no test failing anywhere. Nobody notices until the next audit.

  • Assert the negotiated TLS key-exchange group in CI: fail the build if the deployed endpoint stops offering X25519MLKEM768.
  • Flag newly-introduced dependencies on RSA/ECDSA primitives so crypto debt is reviewed at the pull request rather than inherited.
  • Keep the CBOM current automatically — every merged change updates the inventory instead of drifting away from it.
How it runs

Three steps, start to evidence.

01

Add the step

Drop the Secuur action into your workflow and add an API token as a repository secret. Ten lines of YAML.

02

Record a baseline

The first run captures your current state. From then on the gate speaks only about what changed.

03

Tune the policy

Start in warn-only mode for a sprint, watch the signal, then turn on hard failure once the team trusts it.

Deliverables

What lands in your hands.

  • Pipeline integration for your CI platform
  • Per-repository failure policy configuration
  • Inline pull-request annotations with proof
  • Baseline diffing so only new findings gate
  • TLS key-exchange assertion for deployed endpoints
  • JSON + SARIF output for your own tooling
Questions

Straight answers.

Will this slow our builds down?

The CI pass is time-boxed and tuned to your build budget — typically one to three minutes. The exhaustive crawl runs on the nightly automated scan instead, so depth never comes out of developer wait time.

What happens to our existing backlog of findings?

It is recorded as a baseline and does not fail builds. The gate only blocks on issues the current change introduced, which is what keeps the team from disabling it on day two.

Can we scan preview environments per pull request?

Yes. If your pipeline creates an ephemeral deployment for each PR, point the scan at that URL and the results reflect exactly the change under review rather than a shared staging box.

Does it support SARIF?

Yes. Results are emitted as SARIF as well as JSON, so they render in GitHub code scanning and any other tool that consumes the format.

Related services

Often bought together.

Every engagement starts the same way

Know your grade.
Then pick your service.

The scan is free and takes 20 seconds. It also tells us enough to scope ci-driven scanning properly instead of guessing.