Security scanning inside
the pipeline you already use.
Trigger Strata's repository scan automatically from GitHub Actions or GitLab CI — on every push, every pull request, or a schedule. Catch hardcoded secrets, vulnerable dependencies, and SAST findings before they merge, not after they ship.
Catch it at the pull request, not after deploy
Software supply chain risk enters through the pipeline
A hardcoded credential, a newly vulnerable dependency, or an unsafe code pattern is far cheaper to catch in a pull request than after it has merged, deployed, and shipped to production. Manual, scheduled reviews still leave a gap — anything merged between reviews ships unscanned.
Running the scan as part of the pipeline closes that gap: every change is assessed before it reaches the main branch, using the same checks whether the scan was triggered by a person or by a pipeline event.
GitHub Actions and GitLab CI
Add one step to a workflow you already have — there's no separate CI/CD product to adopt, just a scan step inside your existing pipeline.
GitHub Actions
Trigger a scan as a step in any workflow — on pull_request, push, or a schedule trigger. The API key is stored as a repository secret and referenced in the workflow, never hardcoded.
GitLab CI
Add a job to .gitlab-ci.yml that runs on merge request events or a scheduled pipeline. The API key is stored as a masked GitLab CI/CD variable.
Outbound webhooks
Get notified when a scan completes or a new finding appears, independent of the pipeline step itself — useful for routing results to Slack, a ticketing system, or a separate dashboard.
From API key to blocked merge
Generate an API key
Create a project-scoped API key from your dashboard. Store it as a repository or CI/CD secret — GitHub Actions secret or GitLab CI/CD variable — never in the workflow file itself.
Add a scan step to your pipeline
Add one step to your existing workflow that calls Strata with the API key. No agent to install, no infrastructure to provision — the scan runs against the code already checked out in that job.
Scan runs on push, PR, or schedule
Trigger on every pull request, every push to main, or a nightly schedule — whatever matches how your team already ships. The same four-pass repository scan runs each time: secrets, sensitive files, SAST, and dependency CVEs.
Block or notify on findings
Configure whether new Critical or High findings fail the build, post a PR comment, or only notify — your call, per project.
Track results across every run
Every pipeline-triggered scan appears in the same risk dashboard as manual scans, with full findings history and lifecycle tracking — not a separate CI-only view you have to check independently.
REST API access, including CI/CD triggers, is included on the Team plan. See plan details →
The same four passes, automatically
A pipeline-triggered scan runs the identical engine as a manual repository scan — hardcoded secret detection, sensitive file detection, SAST pattern matching for injection and unsafe code, and dependency CVE lookups against the OSV.dev database. Nothing about the checks themselves changes based on what triggered the scan.
Common Questions
See Strata in action
Watch a walkthrough of the platform — from upload to full security report.
Demo video coming soon
Get a personalized walkthrough of Strata — we will cover your specific workflow live.
Request a Demo →Add a scan step
to your next pipeline run.
Start free to explore repository scanning from the dashboard, then upgrade to Team for API access and CI/CD triggers.