Find the vulnerability. Close the gap.
Vulnara scans your code, dependencies, networks and web applications, and helps you close what it finds: with a pull request it opens for you, an issue in your repository, or a security engineer when it takes one.
CriticalSQL injectionCWE-89
User input reaches a SQL query unescaped
Confirmed by 2 tools
app/reports/query.py
41def reports_for(Scan from your terminal with the vulnara CLI, a single binary for Linux, macOS and Windows. Sign in once in the browser, then start a scan:
vulnara loginvulnara set_default_tenant --tenant my-teamvulnara repositories --limit 20vulnara scan_categoriesvulnara start_repository_category_scan --repositoryId <repository-id> --category SECRETS --branch mainEverything from the web app, no code: set up your team, connect GitHub, run a scan and read your security score.
- 1Create a workspace and invite your team
- 2Add your GitHub organisation under Workspaces
- 3Turn on the repositories you care about
- 4Choose New Scan and keep every category
- 5Read your security score on the Dashboard
Connect Claude, ChatGPT or any MCP client. Neither value is a secret: you sign in with your own Vulnara account and never paste a token.
MCP URL https://vulnara.rso.dev/mcpClient ID hl04e6MSMRY60LdpGh5rdMRQjkPxvldAYoqXdzo4Then ask “Which of my repositories has the lowest security score?”
Fail the build when a scan finds something serious. Store a service account as VULNARA_SERVICE_ACCOUNT and VULNARA_TOKEN in the repository, then add this workflow:
name: Vulnara Scanon: push: branches: [main] pull_request:jobs: vulnara: runs-on: ubuntu-latest steps: - uses: theorigamicorporation/vulnara-action@v1 with: service-account: ${{ vars.VULNARA_SERVICE_ACCOUNT }} token: ${{ secrets.VULNARA_TOKEN }} tenant: my-team fail-on: highSecurity work your team has no time for
Vulnerabilities surface at release time
A finding lands when the release is nearly out, and plans move to make room for it.
Too many alerts, no clear priority
Plenty of findings, little sense of which ones carry real risk.
Scanners disagree with each other
The same issue shows up in several tools, each with its own severity.
One finding, many tools
Confirming a finding, locating the code and updating the ticket means switching systems.
No security expert at hand
A complex vulnerability or a customer's compliance question needs expertise the team may not have.
Fixes compete with the roadmap
The team knows what to fix; finding the time next to feature work is the hard part.
With Vulnara, the week goes back to the work you planned.
See how Vulnara gives that time backWhat Vulnara scans
Code, dependencies, secrets, networks and web applications. When several scanners report the same issue, you see it once.
AI-Powered Remediation
Ranks findings by real risk, then suggests the change or opens the pull request that fixes it.
cur.execute(SQL injectionOpen
SAST & SCA
Static analysis finds injection, XSS and CSRF in your code. Dependency scanning flags vulnerable open-source packages.
PII & Secret Scanning
Finds API keys, passwords and personal data committed to your repositories, before they leak.
Continuous Monitoring
Runs on every push and pull request in your CI, so issues surface before production.
Network Scanning
Finds open ports and the services behind them, on public ranges and on private networks through an agent you run inside.
Web Application Scanning
Tests public web apps from the outside, behind a login too: header, bearer token, cookie or Basic auth. Enabled on request.
- License ComplianceIn developmentFlags open-source licence obligations and conflicts before they reach your product.
- Infrastructure SecurityIn developmentChecks Kubernetes, Terraform, Docker images and cloud services for misconfigurations.
Key features What sets Vulnara apart
Screen recording of Vulnara: the dashboard, the repository scans, a scan's findings and one finding's details with its issue on GitHub
Screen recording of cross-checked findings: the dashboard's findings confirmed by two or more scanners, a confirmed secret in the Vulnerabilities Explorer, and its details with every occurrence
Screen recording of the Vulnerabilities Explorer: findings confirmed by two tools, the dependencies view, a triage decision recorded with its justification, and the finding's details
Screen recording of an alert rule being created: a webhook channel scoped to repositories and networks, a custom payload built from template fields, and a test notification delivered
Pricing
Start free, then pay per minute above the free allowance. For larger estates, we agree terms together.
Free
For startups and small projects
No credit card required
- 500 minutes of repository scanning a month
- 1,000 minutes of network scanning a month
- 500 minutes of web application scanning a month
- 5 repositories, 2 networks and 2 web applications
- 1 scan at a time
- Every scanner, issues and AI fix pull requests
- 500 alert emails a month
Pay as you go
For growing teams and businesses
Billed per minute above the free allowance
- €0.01 per minute of repository scanning above the allowance
- €0.01 per minute of network scanning above the allowance
- No caps on repositories, networks, web applications or parallel scans
- No seats and no contracts
Enterprise
For larger organisations
Plans tailored to your organisation
- Scanning allowances and parallel scans sized to your estate
- Volume pricing and invoicing that fits your procurement
- Guided onboarding with our team
- Network agents for private networks, set up with you
- Contract and data processing terms agreed together
Engineers for the hard calls. Your agent for the routine.
Security engineers on call
When a finding needs judgement rather than a rule, ask for a consultation from the finding itself. An engineer reviews your case, recommends the fix and can help you apply it.
Bind Redis to the private interface and require AUTH. I've drafted the firewall change for you to review.
Your own AI agent
Vulnara runs a live MCP endpoint, so Claude, ChatGPT or any other MCP client can query your scans, findings and posture. Every response is redacted and size-limited.
You
Which critical findings are still open in payments-api?
finding_corroboration
Your agent
Three. Two are confirmed by several tools: a SQL injection in app/reports/query.py and an AWS key in config/settings.py.
Illustrative exchanges.
Integrations Works where you work
Connect the tools your team already uses.
Git providers
- GitHubScan repositories, open issues and fix pull requests
- GitLabScan projects, open issues and fix merge requests
- BitbucketScan workspaces, open issues and fix pull requests
- Azure DevOpsScan organisations, open work items and fix pull requests
- Codeberg / ForgejoScan organisations and users, open issues and fix pull requests
CI pipelines
- GitHub ActionsScan every push and pull request, and fail the job above a severity
- GitLab CI/CDA pipeline job that gates merge requests on findingsIn development
- Bitbucket PipelinesA pipe that checks each commit before it mergesIn development
- Azure PipelinesA task that stops a release above your thresholdIn development
- Forgejo ActionsWorkflows for Codeberg and self-hosted ForgejoIn development
Project management
- JiraCreate and track issues from findingsIn development
- ClickUpFindings as tasks in your workspaceIn development
- GitHub ProjectsFindings on your project boardsIn development
Developer tools
- CLIEvery API operation from your terminal
- GraphQL APIThe API the product runs on, with live events
- MCPYour AI agent reads findings, scans and repositories
- Service accountsMachine credentials for CI and automation
Frequently asked questions
Setup, pricing, security and the rest. If your question is not here, ask us .
Connect your GitHub, GitLab, Bitbucket, Azure DevOps or Codeberg organisation and import your repositories; with a git token, private ones too. Vulnara runs several scanners over each repository, counts each issue once however many report it, and shows the results in the dashboard, in CI and as pull request comments.
All the major ones, including JavaScript and TypeScript, Python, Java, Go, Ruby, C and C++, C#, PHP and Rust, plus infrastructure as code such as Terraform, Kubernetes manifests and Dockerfiles. If yours is missing, tell us.
The free tier includes, each month, 500 minutes of repository scanning, 1,000 of network scanning and 500 of web application scanning, with every scanner, for up to 5 repositories, 2 networks and 2 web applications. Pay as you go lifts those caps and bills €0.01 per minute of repository or network scanning above the allowance. For anything larger, contact us.
Connecting a repository takes a few clicks, and the GitHub Action is a few lines of YAML. The documentation has a quick start for developers, security teams, AI users and workspace admins.
Everyone gets the documentation and can reach us by email, and the Human in the Loop option puts a security engineer on a finding that needs one.
Several scanners look at each repository, and a finding more than one of them reports is marked as corroborated, so you know what to trust first. You can mark any finding with a VEX status and a justification, and the decision stays in its history.
Vulnara maps findings to OWASP Top 10, SANS Top 25, PCI DSS, HIPAA, SOC 2, ISO 27001 and GDPR, so you can report against the frameworks you follow. That supports your own compliance work; it is not a certification of Vulnara.
Contact Us
Questions, a demo or custom requirements? Write to us and the team will get back to you.