secureflow
Get started

SECURITY THAT FITS THE PIPELINE

Ship with a
clear decision.

SecureFlow checks supported Python and JavaScript source code in your CI/CD workflow, then gives your pipeline a security decision it can enforce.

Get started Explore the source

Open source · MIT licensed · Private scan history

GATE DECISION POLICY OUTCOME
PASSPromotion permittedALLOW
FAILBlocking findingsBLOCK
ERRORAssessment incompleteBLOCK
Only a complete, policy-compliant scan can pass.

BUILT AROUND YOUR EXISTING TOOLCHAIN

  • Py Bandit
  • S Semgrep
  • E ESLint
  • Python · JavaScript · CI/CD

A SMALL, EXPLICIT SECURITY GATE

From scanner output
to a decision your pipeline can use.

SecureFlow brings configured scanner checks into one consistent, fail-closed result.

01

Scan supported source

Bandit checks Python. JavaScript checks run through Semgrep and ESLint. The current CLI selects .py, .js, .cjs, and .mjs files.

02

Normalize findings

Scanner-specific output is mapped to shared finding fields, including severity, source location, and whether a finding blocks promotion.

03

Evaluate policy

Required checks and blocking findings feed a structured JSON report with a distinct decision and CLI exit status.

04

Keep a scan record

The local API can scan one uploaded file or store a submitted report in SQLite. Accounts keep scan history private; submitted reports remain unverified.

Read the architecture

FOUR STEPS. ONE ENFORCEABLE OUTCOME.

A gate that knows
when it cannot decide.

  1. 01

    Scan source

    Run the checks for supported Python or JavaScript files.

  2. 02

    Normalize findings

    Bring scanner results into a consistent structure.

  3. 03

    Evaluate policy

    Require complete checks and assess blocking findings.

  4. 04

    Decide promotion

    Permit promotion only when the overall result is PASS.

TRANSPARENT BY DESIGN

An error is not a green light.

Missing checks, invalid results, and scanner errors produce ERROR. Both ERROR and FAIL deny promotion. A PASS means only that the configured checks completed without policy-blocking findings; it does not prove code is vulnerability-free or make this project production-ready.

Threat model Authentication plan MIT license

TRY THE CURRENT BUILD

Explore the scan console.

Run a single-file scan and inspect the API's current local history view.

Open scan console