Catch security issues before they reach your main branch. Zagware Scanner runs IaC, dependency, and secrets scanning in one container on every pull request — and posts a single comment showing only the findings that PR actually introduces, not the hundreds that may already exist in the codebase.
Your team sees exactly what they need to act on. Existing findings are ignored — the scan diffs base branch against PR branch by content fingerprint, not line number, so refactoring and line shifts never create noise.
Comparing main → feat/add-storage
| Base branch | This PR | New | |
|---|---|---|---|
| Findings | 342 | 359 | 17 |
⚠️ 17 new IaC finding(s) · 🔴 1 CRITICAL 🟠 5 HIGH 🟡 6 MEDIUM 🔵 3 LOW ⚪ 2 INFO
| Base | This PR | New | |
|---|---|---|---|
| Vulnerabilities | 12 | 18 | 6 |
⚠️ 6 new vulnerability(ies) · 🔴 1 CRITICAL 🟠 3 HIGH 🟡 2 MEDIUM
| CVE | Package | Installed | Fix | CVSS | KEV |
|---|---|---|---|---|---|
| CVE-2023-1234 | lodash (npm) | 4.17.20 | 4.17.21 | 9.8 | No |
| Base | This PR | New | |
|---|---|---|---|
| Findings | 2 | 3 | 1 |
🌐 PUBLIC REPOSITORY — any leaked secret here is immediately exposed to the world. Rotate affected credentials before merging.
🔴 1 new secret(s) introduced by this PR
| Rule | File | Line | Validation |
|---|---|---|---|
| stripe-access-token | config/payments.rb | 5 | 🔴 Valid |
A single Docker image runs KICS, Syft + Grype, and betterleaks — the wrapper auto-detects what's present in your repo and only runs what's relevant.
Scans Terraform, Kubernetes, Dockerfile, CloudFormation, ARM, Ansible, Helm, OpenAPI, Docker Compose, GitHub Actions, Serverless Framework, and Pulumi for misconfigurations, insecure defaults, open ports, and missing encryption.
Syft builds an SBOM, Grype matches it against CVE/GHSA advisories for npm, pip, Go, Maven, Gem, Rust, PHP, .NET, and OS packages in Dockerfiles — with CVSS, EPSS, and KEV catalog status on every finding.
Scans working-tree contents of both branches for leaked API keys, tokens, and private keys. No severity taxonomy — findings are prioritized by repo visibility, since a secret in a public repo is urgent by default.
Each finding is fingerprinted by rule, resource, and content — not line number. Existing findings never show up as "new," even after refactoring. Fix one and it drops out of the diff immediately.
Comment /zagware suppress <id> <reason> on a PR to silence a false positive — the scanner commits it to .zagware/suppressions.yaml and re-runs in place. No manual YAML editing required.
Every image is cosign-signed with SLSA Build Level 3 provenance and an SPDX SBOM attestation. Every bundled binary (KICS, Syft, Grype, betterleaks) is checksum- and signature-verified at build time.
The scanner clones your base branch and PR branch using your existing CI token — no extra credentials to configure.
KICS scans IaC files, Syft + Grype scan package manifests, and betterleaks scans the working tree — all three run concurrently against both branches.
A finding that already existed on the base branch is never reported as new, even after the file was reformatted or moved.
One in-place PR comment, updated on every push — never duplicated. Set ZAGWARE_FAIL_ON_NEW: true to block the merge on new findings.
Set ZAGWARE_PLATFORM_URL / ZAGWARE_PLATFORM_TOKEN to send results to the Git Tracking Platform for scan history, trend charts, and suppression audit trails. Entirely optional — the scanner works standalone with no account.
A single Docker image, four platforms. Org-wide enforcement is available on GitHub (org rulesets, Team+) and GitLab (Pipeline Execution Policy, Ultimate) so scanning can't be silently removed.
docker://ghcr.io/zagware/zagware-scanner:latest · triggers on pull_request, plus issue_comment for /zagware suppress.
Runs as an image: job gated on merge_request_event; needs a project/group access token for MR notes.
Runs on every pull request step; needs an Atlassian API token and email as repository variables.
Runs via docker run in a PR-triggered pipeline; usually needs no setup beyond mapping $(System.AccessToken).
Zagware Scanner is Apache 2.0 licensed and free to run standalone, forever — no account, no platform token required. Self-host the image or pull it straight from GHCR.