Security scanning for
GitHub and GitLab repositories.

Strata scans your source code for hardcoded secrets, sensitive files committed to version control, SAST vulnerability patterns, and dependencies with known CVEs — across GitHub, GitLab, and ZIP archives. Findings are severity-ranked with file-level evidence, OWASP mapping, and actionable remediation guidance.

GitHub & GitLab
Public and private repos
26 secret rules
Entropy-filtered detection
OWASP Top 10 2021
SAST + dep vulnerability mapping

Four passes. One scan.

Source code analysis that covers the whole attack surface

Repository security issues fall into four distinct categories that traditional code review rarely catches systematically: secrets that should never have been committed, sensitive files that were added accidentally, vulnerability patterns in application code, and third-party dependencies with known CVEs.

Strata runs all four passes on every scan. For GitHub and GitLab, it performs a depth-1 shallow clone — no repository history is stored. For private repositories, access tokens are passed to git via a secure credential helper and never appear in process arguments or logs.

SAST results are regex-based heuristics that flag suspicious patterns for human review. They are not semantic analysis and do not perform data-flow or taint tracking. Confidence levels and evidence snippets are included so reviewers can triage quickly.

GitHub, GitLab, and ZIP archive sources
Private repos via personal access token — never logged
Up to 5,000 files per scan, 256 KB per file
node_modules, vendor, build artifacts automatically skipped
acme-corp/payments — scan results
CRITICAL
src/aws/client.py:14
aws access key id
CRITICAL
deploy/certs/server.pem:1
private key material
CRITICAL
infra/terraform.tfstate
terraform state
HIGH
config/settings.js:31
stripe live secret key
HIGH
.env.production
env file
HIGH
app/database.py:8
database url with creds
HIGH
scripts/deploy.sh:5
github personal access token
+ SAST findings · dependency CVEs

What Strata finds in real repositories

These are the most frequently discovered security issues in source code repositories — each detectable by Strata without running the application.

CRITICAL

.env files in version history

Environment files committed to a repository expose every credential in them to everyone with access — including historical access. Even after deletion, the secret remains in git history. Strata detects .env and .env.* patterns and flags them as high-priority findings.

CRITICAL

Cloud credentials hardcoded in source files

AWS access keys, GCP service account JSON, Azure connection strings, and GitHub tokens hardcoded in source files are detectable by anyone who can read the repository. Strata uses 26 targeted rules with Shannon entropy filtering to minimize false positives.

CRITICAL

Terraform state files committed

Terraform .tfstate files contain the complete configuration of deployed infrastructure in plaintext — including all resource attributes, database passwords, and access tokens written by providers. Strata flags these as Critical regardless of content.

HIGH

SQL injection patterns in application code

String concatenation and f-strings inside SQL execute() calls are a reliable injection indicator across Python, JavaScript, and Java codebases. Strata's SAST rules detect these patterns at the file and line level — results are heuristic and require human review to confirm.

HIGH

Dependencies with known CVEs

npm, PyPI, and Maven packages are cross-referenced against the OSV.dev vulnerability database. Each finding includes the CVE or GHSA ID, severity, the affected version range, and the first safe version to upgrade to.

HIGH

Weak cryptography in application code

MD5 and SHA-1 in password hashing or HMAC, DES/RC4 cipher usage, ECB mode, and java.util.Random for security-sensitive operations are all detectable from source. Strata maps each to OWASP A02:2021 (Cryptographic Failures) and CWE.

What Strata checks

Every check runs automatically on every repository scan.

🔑

Secret scanning

26 rules · entropy filtering · placeholder detection
AWS access key IDs (AKIA/ASIA/AROA) and secret access keys
Azure storage keys, client secrets, and Service Bus connection strings
GCP API keys, OAuth client secrets, and service account private key JSON
GitHub PATs (ghp_, github_pat_) and OAuth tokens
GitLab PATs (glpat-) and OAuth tokens
Stripe live secret and restricted keys
Slack bot, app, and user tokens
SendGrid, Twilio, Mailgun, and npm tokens
Private key material (RSA, EC, DSA, OPENSSH, PGP)
JWT signing secrets and JWT tokens
Database URLs with embedded credentials (Postgres, MySQL, MongoDB, Redis)
Generic API keys, tokens, and hardcoded passwords
🗂

Sensitive files

21 file patterns · commit history aware
.env and .env.* files committed to the repository
SSH private keys: id_rsa, id_ecdsa, id_ed25519, id_dsa
Terraform state files (.tfstate) — contain all infrastructure secrets
Terraform variable files (.tfvars)
GCP service account key files (service_account*.json)
PEM certificate and key files
Java keystores (.jks, .p12, .pfx)
Database config files and WordPress wp-config.php
.htpasswd, .pgpass, .netrc credential files
credentials.json, secrets.yml, secrets.json
Shell history files (.bash_history, .zsh_history)
🛡

SAST — injection & execution

Python · JavaScript · TypeScript · Java · Kotlin
SQL injection — f-strings and .format() in Python execute()
SQL injection — template literals and concatenation in JS/TS query()
SQL injection — Statement (not PreparedStatement) in Java/Kotlin
Command injection — os.system(), subprocess(shell=True), os.popen()
Command injection — exec()/execSync() with dynamic strings in JS/TS
Command injection — Runtime.exec() and ProcessBuilder with concatenation
SSRF — requests/urllib with user-controlled URLs (Python)
SSRF — fetch()/axios() with request-derived URLs (JS/TS)
SSRF — new URL(getParameter()) in Java servlets
⚠️

SAST — code quality & crypto

Python · JavaScript · TypeScript · Java · Kotlin · Swift
XSS — innerHTML/outerHTML assignment in JavaScript/TypeScript
XSS — eval() with external data, document.write(), dangerouslySetInnerHTML
XSS — mark_safe()/Markup() bypass in Python templates
XSS — unescaped getParameter() write in Java servlets
Insecure deserialization — pickle.loads(), yaml.load() without SafeLoader, marshal
Insecure deserialization — Java ObjectInputStream and XMLDecoder
Weak cryptography — MD5/SHA-1/DES/RC4/ECB across Python, JS, Java, Swift
Weak randomness — java.util.Random for security-sensitive operations
Hardcoded Basic Auth, JDBC credentials, and Swift Keychain literals
📦

Dependency vulnerabilities

OSV.dev · CVEs · advisories
npm — parses package.json for declared dependency versions
PyPI — parses requirements.txt, poetry.lock, Pipfile.lock
Maven — parses pom.xml and build.gradle / build.gradle.kts
Cross-references up to 200 packages per scan against the OSV.dev database
Returns CVE IDs, GHSA IDs, severity, and affected version ranges
No API key required — open vulnerability database
🌐

Language detection

20+ languages detected across the repository
Python, JavaScript, TypeScript, Java, Kotlin, Go, Rust
Ruby, PHP, C#, C++, C, Swift, Objective-C, Dart
Shell, PowerShell, SQL, HTML, CSS/SCSS
Configuration formats: JSON, YAML, TOML, Terraform
File count and language breakdown reported with every scan
Up to 5,000 files scanned, 256 KB per file

From repository to remediation

Paste a URL, get findings. Track them to resolution.

01

Connect or upload

Paste a GitHub or GitLab URL — public or private. For private repos, provide a personal access token and Strata passes it to git via a secure credential helper so it never appears in process arguments. Or upload a ZIP archive directly.

02

Shallow clone & scan

Strata performs a depth-1 shallow clone, walks up to 5,000 files (skipping node_modules, vendor, build artifacts, and binaries), and runs all four scan passes in parallel: secrets, sensitive files, SAST, and dependency analysis.

03

Review ranked findings

Findings are ranked by severity — Critical through Low — with file path, line number, evidence snippet, OWASP category, CWE reference, and specific remediation guidance. SAST results note that patterns are heuristic and require human confirmation.

04

Triage with lifecycle

Move findings through Open → In Progress → Fixed or Accepted Risk. Add notes, mark false positives, and record the rationale for accepted risks. History is preserved across rescans.

05

Export and report

Generate a PDF report with executive summary, severity breakdown, OWASP Top 10 coverage, and per-finding evidence — suitable for engineering handoff, compliance documentation, or client delivery.

Works where your code lives

GitHub, GitLab, and your CI/CD pipeline

Strata connects directly to GitHub and GitLab — public and private repositories — via URL. No GitHub App installation or GitLab OAuth consent screen required to get started: paste a URL, provide a token for private repos, and scan.

For teams that want scanning as part of the development lifecycle, Strata's API supports trigger-based and scheduled scans. Run a scan on every pull request, on a nightly schedule, or on demand before a release — all tracked in a single risk dashboard with full findings history. See CI/CD security scanning for GitHub Actions and GitLab CI setup.

The risk dashboard gives you a cross-repository view of open findings by severity, repository, and category. Track which repositories have unresolved Critical or High findings and measure remediation progress over time.

GitHub.com and GitLab.com — public and private repositories
API-triggered scans for CI/CD pipeline integration
Scheduled scans — daily, weekly, or on demand
Risk dashboard — cross-repository findings overview
Findings lifecycle tracks remediation status across scans
Source
🐙
GitHub
github.com repos, public and private
🦊
GitLab
gitlab.com repos, public and private
📦
ZIP archive
Upload any source code archive
Triggers
On demand
Scan any time via UI or API
🔄
Scheduled
Daily or weekly automated scans
🔗
CI/CD triggered
API integration for PR pipelines

Common Questions

No. Strata performs a depth-1 shallow clone to run the scan — no repository history is stored, and for private repositories, access tokens are passed to git via a secure credential helper that never appears in process arguments or logs.
No. SAST results are regex-based heuristics that flag suspicious patterns for human review — they are not semantic analysis and do not perform data-flow or taint tracking. Each finding includes confidence level and evidence so a reviewer can triage quickly.
Yes. Provide a personal access token for the private repository, and Strata passes it to git via a secure credential helper — it never appears in process arguments, logs, or stored scan data.
Yes — repository scans can trigger automatically from GitHub Actions or GitLab CI on every push or pull request, in addition to running manually from the dashboard. See CI/CD security scanning for setup details.

See Strata in action

Watch a walkthrough of the platform — from upload to full security report.

Demo video coming soon

Get a personalized walkthrough of Strata — we will cover your specific workflow live.

Request a Demo →

Scan your first repository
in under 60 seconds.

Free to start — paste a GitHub or GitLab URL and get a full security report. Upgrade for unlimited scans, private repo support, findings lifecycle, and scheduled CI/CD scanning.