GitHub-native security analysis
One truthful security result, with its evidence intact.
Vulnatest selects qualified analyzers for each repository, preserves their provenance, correlates related observations, and shows exactly what completed, failed, or was unsupported.
One repository is free with no credit card required. Pro protects unlimited repositories for €19 per workspace each month.
A measured control plane, not another opaque scanner.
Qualified analyzer lanes
Managed tools and customer-owned result imports
Every observation retains engine, configuration, and rule identity
Truthful coverage
Clean and fully analyzed are separate facts
Required failures, timeouts, and unsupported cells stay visible
How it works
Vertical pilot scope
The current v2 pilot exposes JavaScript/TypeScript CWE-78 through a pinned Opengrep adapter and a Vulnatest-owned experimental rule pack. Experimental observations are non-blocking until independent evidence qualifies the exact capability cell. Additional CWE, SCA, and secret lanes are introduced only after their release gates pass.