CI/CD Security

Break the build on what's exploitable — not on noise.

Run BreachLens from any pipeline with a single CLI command. Findings come back inline on the pull request, and the build fails only on what's actually reachable and severe — so a security gate is something engineers trust instead of route around.

Book a technical demo Read the CLI docs

One CLI, any CIFindings in the PRTalks to your BreachLens, not ours

A gate engineers trust

Security gates that cry wolf get ignored.

A scanner that fails every build teaches your team to skip it. BreachLens gates on what's reachable and proven, warns on the rest, and puts the detail in the PR — so the gate stays credible and the pipeline keeps moving.

Add

One CLI in your pipeline

Drop the BreachLens CLI into GitHub Actions, GitLab CI, Jenkins, or any runner. It points at your own BreachLens deployment.

Scan

On every pull request

Fast tiers run in the pipeline; findings post back to the PR so reviewers see them on the diff, not in a separate tool.

Gate

Fail on what matters

Configure the build to fail on reachable, severe, or proven findings — and merely warn on the long tail.

What you get

Security in the pipeline that doesn't fight the pipeline.

One CLI, any CI

Not tied to one vendor.

· GitHub Actions, GitLab CI, Jenkins, or any runner that runs a command.
· A single binary — no per-CI plugin zoo.
· The same command locally as in the pipeline.

Findings in the PR

Where the review already happens.

· Check runs post findings inline on the pull request.
· Reviewers see the issue on the diff, not in another tab.
· Merge decisions stay in your code host.

Reachability-aware gates

Fail on exploitable, warn on the rest.

· Gate the build on reachable and proven findings.
· Warn — don't block — on the unreachable long tail.
· A threshold your team won't learn to bypass.

Self-hosted by design

Your pipeline, your data.

· The CLI talks to your own BreachLens, never our cloud.
· Source and findings never leave your network.
· Works in air-gapped and regulated pipelines.

Straight answers

What a platform team asks about CI/CD.

Which CI systems does it work with?

Any of them. It's a single CLI command, so it runs in GitHub Actions, GitLab CI, Jenkins, or any runner. Pull-request check runs are available on GitHub via the BreachLens App; the CLI itself is CI-agnostic.

Does my code go to your cloud?

No. The CLI talks to your own self-hosted BreachLens. Source and findings stay inside your network — it works in air-gapped pipelines.

Won't a security gate slow every build down?

You choose what gates. Fast tiers run in the pipeline and BreachLens fails the build only on reachable, severe, or proven findings — the deep, slower analysis runs out of band, not on the critical path of every PR.

How do I decide what fails the build?

By severity, reachability, and proof of exploit — so “fail” means “an attacker could use this,” not “a scanner had an opinion.” The long tail warns instead of blocking.