AppScan
Integrations

Fits where you already work.

A security tool nobody opens is a security tool nobody uses. AppScan pushes what it finds into the places you already look, and gets out of the way everywhere else.

Connect a repository Read the docs
GitHub App

Install once, connect repositories to a site. Pushes are coalesced into change sets, pull requests get a check, and Fix with AI opens a draft branch.

Slack

A webhook per organization. Instant alerts are grouped and cooled down so one bad deploy does not become forty messages.

Email alerts and digests

Instant for what cannot wait, a digest for the rest, and per-user preferences on top of the organization setting.

Advisory feed

Lockfile versions are matched against public advisories, and affected apps are targeted for re-evaluation daily.

Exports

Any report or issue list as CSV, JSON or a PDF you can hand to a client without editing it first.

JSON API

Everything the app does is available over the API, with the same permissions and the same tenancy rules.

Stripe, PayPal and Paddle billing

Plans, top-ups, refunds and disputes behind signed idempotent webhooks and a normalized subscription state. Paddle sells as merchant of record, on our own checkout page.

Prometheus metrics

API and worker both expose scrape endpoints: HTTP, jobs, queues, GitHub, AI spend and scan outcomes.

01GitHub

One App, the permissions you grant.

Install it on the repositories you choose. AppScan reads code and metadata, writes check runs, and opens draft pull requests when you ask it to. A deleted installation is noticed and healed rather than left rotting in the database.

  • push
    Coalesced into a change set, classified and scanned.
  • pull_request
    A check run with NEW and UNCHANGED verdicts against the base branch.
  • installation
    Suspended, resumed or removed installations are noticed, never left rotting.
  • installation_repositories
    Repositories appear and disappear as you grant and revoke access.
  • deployment_status
    A successful production deployment records which commit is live.
slack · #engineering
AS
AppScan 09:42
Criticalcheckout-app · 2 new findings
A Stripe secret key is committed to the repository
Introduced in “Add bulk refund endpoint” · 14 commits
Grouped with 1 other finding · next alert for this site in 30 minutes
02Alerts

Loud when it matters, quiet otherwise.

Instant alerts are grouped per site and cooled down, so one bad deploy is one message rather than forty. Everything that can wait arrives in a digest. Each person can narrow what they receive on top of the organization setting.

03Exports and API

Your data leaves easily.

  • CSVIssue lists and report tables, for a spreadsheet or a ticket import.
  • MarkdownA report as text you can paste into a ticket, a wiki or a pull request.
  • JSONThe same data the API returns, for anything you want to build on it.
  • PDFA report you can hand to a client or attach to a questionnaire.

Audit-log exports can also be scheduled, and streamed to a SIEM if you keep one.

Wire it into your week.

Connect GitHub, point alerts at a Slack channel, and let the rest happen without anyone remembering to run a scan.

Create an account See pricing