Continuous AppSec
Continuous scanning, outside your pipeline
Connect GitHub once. jeerc scans every repository you pick on a schedule, outside CI, and tells you when one goes 7 days without a scan.
What runs on every scan
- SAST: risky patterns in your source code.
- SCA: vulnerable open-source packages, with reachability to show which ones your code actually calls.
- Secret Scanning: secrets committed to your repositories.
- IaC Scanning: misconfigurations in Terraform, Kubernetes and more.
All four are on the Free plan, with no card. Team adds Agentic SAST, an AI agent that reads your code for issues rules miss.
The schedule
Scans run on a schedule you set per repository or per team, in your timezone. Commits that have not changed since the last scan are skipped. One scan is one repository checked by all the code scanners at once.
Free runs 50 scans a day, so 400 repositories are covered over about 8 days. Team runs 500 a day, and Business 3,000.
When scanning stops
If a repository you connected goes 7 days without a successful scan, you get an email, a Matrix message or a webhook, wherever you pointed alerts during setup. You can change the threshold. A failed scan does not count as covered.
Why outside the pipeline
- It covers every repository you connect, including ones with no pipeline and ones nobody has pushed to in months.
- It never runs in your build, so it uses none of your build minutes.
- There is no step to add to each pipeline and keep working.
After a finding (Team)
An AI verdict says whether a finding is exploitable, and why. An AI fix must pass a re-scan by the scanner that found the issue, and a patch that adds a secret or changes more than 400 lines is refused. A person approves every verdict and fix, and your team merges every pull request. Nothing merges on its own.
Supply chain and reports
jeerc keeps a package inventory of your repositories and exports SBOMs as CycloneDX or CSV, with CVEs ranked by exploitability. Weekly digests and evidence mapped to PCI DSS, SOC 2, ISO 27001 and DORA say what the scans show, and what they do not.
What it does not cover yet
GitHub only for now, including GitHub Enterprise Server.