It runs where your code already goes.
Every merge triggers a run. Findings land as tickets in the board you already use, in the channel your team already reads. Nobody has to open Cipher for Cipher to work.
GitHub
GitLab
Bitbucket
Jenkins
Jira
Linear
Slack
Teams
OktaA pull request opens. Nobody does anything.
This is the whole workflow. It happens on every change, whether or not anyone is watching.
A webhook from GitHub, GitLab, or Bitbucket tells Cipher what changed and where it deployed.
Scoped to what moved. New and changed endpoints get the deep pass, the rest gets a regression check.
Nothing is reported until it has been reproduced, so no one spends a morning on a false positive.
In Jira or Linear, on the right team, with the reproduction steps and the commit that introduced it.
The next run retests the fix. If it holds, the ticket closes on its own. If it does not, it reopens.
Optionally it blocks the merge. Most teams start with warnings only, then turn on the gate for criticals once they trust the signal.
Wherever your pipeline runs, Cipher runs with it.
Native app, or a single job step. Both take about ten minutes to set up, and neither needs your source code to leave your systems.
GitHub ActionsNATIVE APPInstall the app, pick your repos. Runs fire on merge to any branch you nominate, and results post back as a check plus an annotated PR comment.
- uses: cipher/scan@v1
with:
fail-on: criticalGitLab CINATIVE APPSelf managed or SaaS. Findings arrive in the merge request widget alongside your own security reports, in the format GitLab already renders.
cipher: stage: test image: cipher/cli
BitbucketNATIVE APPPipelines integration with the same gating options, and Jira linking that works out of the box because both live in your Atlassian tenant.
- pipe: cipher/scan:1
variables:
FAIL_ON: criticalJenkins
CircleCI
Azure DevOpsFindings go where your team already is.
Nobody adopts another dashboard. So Cipher pushes into the tools you have, with two way sync wherever the tool supports it.
Not on the list? Everything above is built on the same public API and webhook system you get, so anything with an endpoint can be wired up in an afternoon.
ASK ABOUT YOURSConnecting Cipher does not hand us your code.
The pipeline integration tells Cipher that something changed and where it now runs. It tests the deployed system from the outside, the way an attacker reaches it.
READ THE TRUST MODELWire it into one repo this week.
Pick a service, connect the pipeline, and watch the first run go on your next merge. No procurement cycle needed to see it work.