CI/CD Secure Code Review¶

Automated security analysis on every pull request. SAST scanning + AI-powered enrichment integrated directly into your existing CI/CD pipeline.

How It Works¶

graph TB
    A["Developer pushes code<br/>PR / Merge Request"] --> B["CI Runner<br/>(GitHub Actions / GitLab CI / Azure)"]
    B --> C["bd-sast Docker container<br/>semgrep, bandit, gosec,<br/>gitleaks, trivy, brakeman"]
    C --> D["SAST Results<br/>(sast-results.json)"]
    D --> E{"BeDefended API<br/>api.bedefended.com"}
    E -->|Essentials| F["Normalize + SARIF"]
    E -->|Professional| G["Claude AI Analysis<br/>taint flow, remediation"]
    E -->|Enterprise| H["Claude + Codex<br/>dual-engine verify"]
    F --> I["PR Comments +<br/>Security Tab +<br/>Quality Gate"]
    G --> I
    H --> I

    style A fill:#4a148c,color:#fff
    style B fill:#6a1b9a,color:#fff
    style C fill:#7b1fa2,color:#fff
    style E fill:#0277bd,color:#fff
    style G fill:#00838f,color:#fff
    style H fill:#00695c,color:#fff
    style I fill:#2e7d32,color:#fff

Key Features¶

Quick Setup (5 minutes)¶

# .github/workflows/code-review.yml
name: Code Review
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
  security-events: write

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: bedefended/code-review-action@v1
        with:
          api-key: ${{ secrets.BD_API_KEY }}
          fail-on: high
          sarif-upload: true
          pr-comments: true

# .gitlab-ci.yml
include:
  - remote: 'https://raw.githubusercontent.com/bedefended/bd-app/main/ci/gitlab/.bedefended-ci.yml'

# Set BD_API_KEY as masked CI/CD variable in
# Settings > CI/CD > Variables

# azure-pipelines.yml
resources:
  repositories:
    - repository: bedefended
      type: github
      name: bedefended/bd-app
      endpoint: github-connection

extends:
  template: ci/azure/bedefended-review.yml@bedefended
  parameters:
    failOn: 'high'

SAST Tools Included¶

The bd-sast Docker image (~800MB) includes:

Pricing¶

Documentation¶