Syntak Security suite

Syntak Code Security · Features

Everything Syntak Code Security does.

Syntak Code Security runs code, secret, dependency, and dynamic scans from your CI, builds an SBOM for every scan, and turns the results into findings your team can triage, waive, and gate on. Here is what it does today.

Sign up for Syntak Code Security Back to Syntak Code Security 45 features in 9 areas
scanners in the CI image: Semgrep, Gitleaks, Trivy, and Syft
4
languages with dedicated code-scanning rules
6
CycloneDX SBOM version
1.5
built-in triage rules, plus your own
9
roles: admin, security, and developer
3
01

Scanning engines

Code, secrets, dependencies, and a running site, scanned in CI and reported to one place.

  • Code scanning

    Find insecure code patterns with Semgrep, using rule packs chosen for the languages detected, plus an extra rule for PHP command injection.

  • Secret detection

    Find committed credentials with Gitleaks. Projects can supply their own Gitleaks configuration.

  • Dependency vulnerabilities

    Find known vulnerabilities in packages with Trivy and OSV, with duplicates merged into one finding.

  • Dynamic scan of a running app

    Check a project's HTTPS target with the OWASP ZAP baseline scan, or with HTTP security-header checks if ZAP is not installed.

  • Per-project controls

    Turn each engine on or off, include and exclude paths, choose Semgrep packs, and set Trivy severity filters.

  • Fast merge-request scans

    Merge-request scans cover only changed files, and an incremental per-commit cache reuses earlier results.

02

SBOM and dependencies

A software bill of materials for every scan, and a view of what changed.

  • CycloneDX SBOM per scan

    Produce a CycloneDX 1.5 JSON inventory using Syft, falling back to Trivy and then a built-in lockfile parser.

  • Download any SBOM

    Download the SBOM for any scan as a CycloneDX file.

  • Compare two scans

    See components added, removed, and unchanged between two scans.

  • Wide lockfile coverage

    Read composer.lock, package-lock.json, package.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, Gemfile.lock, go.sum, and Cargo.lock.

  • Exploit-aware prioritization

    Use CISA Known Exploited and EPSS data to flag vulnerabilities that are being exploited or are likely to be.

03

Findings and triage

A finding keeps its identity across rescans, so triage work is not lost.

  • Stable findings

    Each finding keeps its first-seen date and an occurrence history across scans, and a resolved finding that reappears reopens.

  • Workflow statuses

    Move findings through open, assessed, remediating, resolved, and accepted.

  • Assessment that never inflates severity

    Record a reason such as false positive or not reachable. It can lower the displayed severity but never raise it above what the scanner reported.

  • Triage rules

    Nine built-in rules and your own can cap severity, skip probes, or hide noise, and can be previewed and applied to existing findings.

  • Waivers and exceptions

    Grant time-limited waivers, or request exceptions that need approval, with bulk approve and decline.

  • Filters and a suggested focus

    Filter findings, and set an organization-wide suggested focus that drives the dashboard counts.

  • SLA clocks

    Due dates default to 7 days for critical, 14 for high, and 60 for medium, and vary with whether a finding was confirmed or refuted.

04

CI/CD gates and policies

Stop a pipeline for the findings that matter, and nothing else.

  • Severity gate

    Fail a pipeline when open findings exist at the severities you choose. Waived, accepted, and resolved findings do not block. The default blocks critical only.

  • Risk-level gate

    Also block on risk level, critical by default.

  • Choose the scope

    Gate only new findings, the whole project, or a branch. The default is new findings only.

  • GitLab commit status GitLab

    Post a commit status, including a running state while verification is pending.

  • GitLab merge request widgets GitLab

    Produce GitLab-format SAST, secret detection, and dependency scanning reports.

  • Scheduled scans

    Run daily or weekly scans per project, full or changed files only.

  • CI setup help

    Generate a ready-made CI job and a CI token.

05

Repositories and integrations

Plug into the pipeline and the tracker you already have.

  • GitLab connection GitLab only

    Connect a project by repository URL and access token, with the token held in a secrets store and only approved GitLab hosts accepted.

  • Jira tickets Dry run by default

    Create and comment on tickets from findings and sync status both ways. Sync is a dry run until you turn it on for a project.

  • CI snippets for other platforms

    Generate setup for GitHub Actions, Azure Pipelines, Jenkins, and a generic script.

  • REST API and service accounts

    Automate with a documented OpenAPI API and service account keys.

06

Reporting and exports

Evidence you can hand to an auditor or load into another tool.

  • Audit export

    Export the audit log as NDJSON.

  • Evidence export

    Export findings, Jira events, and audit entries as JSON.

  • Policy export

    Export your organization's policy as JSON.

  • Signed penetration test report

    Produce a frozen, signed HTML report you can print to PDF. It covers the AI penetration test, not scanner findings.

07

Dashboard and visibility

See where you stand, and where the scanners and the people disagree.

  • Dashboard

    See open findings by severity, SLA breaches, per-project counts, and recent scans.

  • Scanner rating beside triaged severity

    Compare what the scanner reported with the severity after triage.

  • Live scan activity

    Watch scan progress and the status of each engine.

  • Code graph context

    Use call-path context from a code graph to help rank findings.

08

Access and administration

Roles, strong sign-in, and an audit trail.

  • Three roles

    Admin, security, and developer, with developers limited to the projects they are granted.

  • Authenticator-app MFA

    Required for admin and security roles by default.

  • Single sign-on with OIDC Off by default

    Sign in with a generic OIDC provider. It is off by default and needs an invite unless auto-provisioning is turned on.

  • Invites and sessions

    Invite links expire after 7 days and sessions last 12 hours.

  • Append-only audit log

    Record sign-ins, configuration changes, scans, waivers, and gate decisions.

09

AI-assisted assessment

An optional add-on that verifies findings and looks for what scanners miss. It never affects the CI gate.

  • Automated assessment Optional add-on

    Run a source review, or an HTTP probe against an allowlisted non-production environment, to help confirm a finding.

  • Agent penetration test Optional add-on

    Run a white-box review of the repository using Cursor, Claude, or OpenAI engines that you connect yourself.

  • Dynamic test and attack chains Optional add-on

    Run a black-box agent against a running app, and build multi-step exploit paths from findings.

Syntak Code Security

Start with Syntak Code Security.

Run DevSec scans, SBOMs, findings, and CI gates in one application security workflow.

Sign up for Syntak Code Security See pricing