Skip to main content
AQIRA
Book a demo
AQIRA

Menu

Book a demo

Solutions / Code repositories

SAST, secret detection and SCA on every repository

With a read-only token, AQIRA traces tainted input from source to sink, builds the software bill of materials, and reviews dependencies, infrastructure code and CI permissions. Committed secrets are verified, their values never shown.

Book a demoHow an assessment runs
You provide
A Git repository
Intensity
Standard, Deep
Grouped by weakness
CWE
Plans
On Premium, with 3 repositories, and Enterprise, with 20. Compare the plans
AQIRA consoleNew assessmentProduct UI, demo data
AQIRA's New assessment dialog with Code repository selected: the repository URL, a read-only access token, the branch and a Connect repository button.AQIRA's New assessment dialog with Code repository selected: the repository URL, a read-only access token, the branch and a Connect repository button.
The New assessment step for a repository: URL, read-only token, branch and the Connect repository button.View full size: the New assessment screenView full size: the New assessment screen

What you hand AQIRA

On a code repository, the New assessment step asks for the following.

You provide
A Git repository URL and a read-only access token, with an optional branch.
Access
The token is stored encrypted and never shown again. A token scoped to read the repository is enough.
Authorisation
The assessment starts only once the operator confirms: I am authorized to scan this repository.
Intensity
  • Standard. Active testing with safe, non-destructive proofs of concept.
  • Deep. Chained, in-depth exploitation to prove impact. Still non-destructive.

What each input's access allows, and how AQIRA keeps it to the least it needs, is on the security page.

ORION, VEGA, ATLAS, NOVA, POLARIS, SCRIBE

What each agent does on this input

The same six agents, in the same order; on a code repository this is the work.

  1. 01ORIONClone and language detection

    Clones the repository and detects its languages.

    • Repository intake
    • Language detection
    • Open-source intel

  2. 02VEGAStatic analysis (SAST)

    Traces taint through the code and hunts committed secrets.

    • Source-code review
    • Taint analysis
    • Secret detection

  3. 03ATLASDependencies, SBOM and IaC

    Builds the SBOM and reviews dependencies and infrastructure code.

    • Dependency risk
    • SBOM generation
    • IaC review

  4. 04NOVASecret verification and supply chain posture

    Verifies secrets and supply chain posture to benign proof.

    • Secret verification
    • Supply chain posture
    • Vulnerability correlation

  5. 05POLARISReview and scoring

    Consolidates what the others found. Groups the findings by CWE and maps them like every other input's.

  6. 06SCRIBEReport

    Writes the client-deliverable report from the same evidence the console shows.

AQIRA consoleCode security / SecretsProduct UI, demo data
The Secrets view of AQIRA's code security screen for northwind-example/web-portal: a Slack webhook in config/prod.env, value masked, with its commit and verification status.The Secrets view of AQIRA's code security screen for northwind-example/web-portal: a Slack webhook in config/prod.env, value masked, with its commit and verification status.
The Secrets view: a webhook in a config file, value masked, with its commit and verification status.View full size: the Code security / Secrets screenView full size: the Code security / Secrets screen

The findings it raises

Examples of what AQIRA reports on a code repository, each with evidence, steps to reproduce, remediation in priority order and its ATT&CK technique.

  • SQL injection through a string-built query
  • Command injection through a shell call
  • Path traversal in a file download handler
  • Cloud access key or private key committed to source
  • Vulnerable dependency, such as Log4Shell in log4j
  • Infrastructure code that opens SSH to the world
  • No branch protection on the default branch
  • CI workflow with overly broad token permissions

Examples only. What an assessment finds depends on your target; the capture shows a demo assessment.

AQIRA consoleFindingsProduct UI, demo data
The findings table of an AQIRA assessment of the repository northwind-example/web-portal: twelve findings from Log4Shell in a dependency and command injection to missing branch protection, with severity and confidence.The findings table of an AQIRA assessment of the repository northwind-example/web-portal: twelve findings from Log4Shell in a dependency and command injection to missing branch protection, with severity and confidence.
The assessment's findings, from code flaws to dependencies and pipeline settings, each with severity and confidence.View full size: the Findings screenView full size: the Findings screen

What it maps, and where results land

A repository assessment opens on its Code tab: findings by CWE, secrets, vulnerable dependencies, the SBOM and the languages analysed. A language with no ruleset is shown as not analysed, never as a pass.

Repository, files and refs
The repository, its branches and pull requests, the files that matter, infrastructure-as-code resources and CI workflows.
SDKs and dependencies
Every dependency, direct and transitive, collected into a software bill of materials.
AQIRA consoleCode securityProduct UI, demo data
AQIRA's code security view of a repository: code findings, secrets, vulnerable dependencies, findings by CWE and language coverage.AQIRA's code security view of a repository: code findings, secrets, vulnerable dependencies, findings by CWE and language coverage.
Findings by CWE, secrets, dependencies and language coverage for one repository.View full size: the Code security screenView full size: the Code security screen

Mapped to what your auditors read

POLARIS maps every finding to the controls it touches, in every framework that applies.

Grouped by weakness

  • CWE

Every finding is also mapped to

ATT&CK, OWASP, NIST CSF, NIST SP 800-53, NIST SP 800-171 and COBIT.

Control status, owner and evidence are in compliance mapping; what reaches the client is in the reports.

Where this assessment stops

A clean result covers only what AQIRA tests on a code repository.

  1. A read-only token

    A token scoped to read the repository is enough. It is stored encrypted and never shown again.

  2. Secrets stay masked

    A secret found in the code is shown masked, with its file and commit. AQIRA never shows its value.

  3. Code, not the deployed system

    A flaw in the repository shows what the code does, not whether a running system is reachable; that needs a domain assessment.

Limits common to every input, and how proof stays benign, are in the methodology.

The other five inputs

Next step

A demo assessment of a code repository

A demo runs one assessment in the console, with demo data: the agents at work, the evidence behind each finding, and the report.

Book a demoExplore the platform