Security scanning for
GitHub and GitLab repositories.
Strata scans your source code for hardcoded secrets, sensitive files committed to version control, SAST vulnerability patterns, and dependencies with known CVEs — across GitHub, GitLab, and ZIP archives. Findings are severity-ranked with file-level evidence, OWASP mapping, and actionable remediation guidance.
Four passes. One scan.
Source code analysis that covers the whole attack surface
Repository security issues fall into four distinct categories that traditional code review rarely catches systematically: secrets that should never have been committed, sensitive files that were added accidentally, vulnerability patterns in application code, and third-party dependencies with known CVEs.
Strata runs all four passes on every scan. For GitHub and GitLab, it performs a depth-1 shallow clone — no repository history is stored. For private repositories, access tokens are passed to git via a secure credential helper and never appear in process arguments or logs.
SAST results are regex-based heuristics that flag suspicious patterns for human review. They are not semantic analysis and do not perform data-flow or taint tracking. Confidence levels and evidence snippets are included so reviewers can triage quickly.
What Strata finds in real repositories
These are the most frequently discovered security issues in source code repositories — each detectable by Strata without running the application.
.env files in version history
Environment files committed to a repository expose every credential in them to everyone with access — including historical access. Even after deletion, the secret remains in git history. Strata detects .env and .env.* patterns and flags them as high-priority findings.
Cloud credentials hardcoded in source files
AWS access keys, GCP service account JSON, Azure connection strings, and GitHub tokens hardcoded in source files are detectable by anyone who can read the repository. Strata uses 26 targeted rules with Shannon entropy filtering to minimize false positives.
Terraform state files committed
Terraform .tfstate files contain the complete configuration of deployed infrastructure in plaintext — including all resource attributes, database passwords, and access tokens written by providers. Strata flags these as Critical regardless of content.
SQL injection patterns in application code
String concatenation and f-strings inside SQL execute() calls are a reliable injection indicator across Python, JavaScript, and Java codebases. Strata's SAST rules detect these patterns at the file and line level — results are heuristic and require human review to confirm.
Dependencies with known CVEs
npm, PyPI, and Maven packages are cross-referenced against the OSV.dev vulnerability database. Each finding includes the CVE or GHSA ID, severity, the affected version range, and the first safe version to upgrade to.
Weak cryptography in application code
MD5 and SHA-1 in password hashing or HMAC, DES/RC4 cipher usage, ECB mode, and java.util.Random for security-sensitive operations are all detectable from source. Strata maps each to OWASP A02:2021 (Cryptographic Failures) and CWE.
What Strata checks
Every check runs automatically on every repository scan.
Secret scanning
Sensitive files
SAST — injection & execution
SAST — code quality & crypto
Dependency vulnerabilities
Language detection
From repository to remediation
Paste a URL, get findings. Track them to resolution.
Connect or upload
Paste a GitHub or GitLab URL — public or private. For private repos, provide a personal access token and Strata passes it to git via a secure credential helper so it never appears in process arguments. Or upload a ZIP archive directly.
Shallow clone & scan
Strata performs a depth-1 shallow clone, walks up to 5,000 files (skipping node_modules, vendor, build artifacts, and binaries), and runs all four scan passes in parallel: secrets, sensitive files, SAST, and dependency analysis.
Review ranked findings
Findings are ranked by severity — Critical through Low — with file path, line number, evidence snippet, OWASP category, CWE reference, and specific remediation guidance. SAST results note that patterns are heuristic and require human confirmation.
Triage with lifecycle
Move findings through Open → In Progress → Fixed or Accepted Risk. Add notes, mark false positives, and record the rationale for accepted risks. History is preserved across rescans.
Export and report
Generate a PDF report with executive summary, severity breakdown, OWASP Top 10 coverage, and per-finding evidence — suitable for engineering handoff, compliance documentation, or client delivery.
Works where your code lives
GitHub, GitLab, and your CI/CD pipeline
Strata connects directly to GitHub and GitLab — public and private repositories — via URL. No GitHub App installation or GitLab OAuth consent screen required to get started: paste a URL, provide a token for private repos, and scan.
For teams that want scanning as part of the development lifecycle, Strata's API supports trigger-based and scheduled scans. Run a scan on every pull request, on a nightly schedule, or on demand before a release — all tracked in a single risk dashboard with full findings history. See CI/CD security scanning for GitHub Actions and GitLab CI setup.
The risk dashboard gives you a cross-repository view of open findings by severity, repository, and category. Track which repositories have unresolved Critical or High findings and measure remediation progress over time.
Common Questions
See Strata in action
Watch a walkthrough of the platform — from upload to full security report.
Demo video coming soon
Get a personalized walkthrough of Strata — we will cover your specific workflow live.
Request a Demo →Scan your first repository
in under 60 seconds.
Free to start — paste a GitHub or GitLab URL and get a full security report. Upgrade for unlimited scans, private repo support, findings lifecycle, and scheduled CI/CD scanning.