Wisec

In your CI, as it is.

Do you have to change your tooling to adopt Wisec?

No. The agent is a single open source binary, added in two steps to any pipeline. Your scanners stay yours: Wisec imports their results.

Open source agent, Apache 2.0Linux and macOS, amd64 and arm64SARIF import
CI platforms

One guide per platform.

Each guide gives the full pipeline, with a pinned version and a verified checksum.

GitLab CITwo jobs, notify and gate.Read the guide →GitHub ActionsOne workflow, two steps.Read the guide →Azure DevOpsYAML pipelines.Read the guide →JenkinsDeclarative pipeline.Read the guide →

Another CI? The agent runs wherever a Linux or macOS binary runs.

In practice

Two jobs in your pipeline.

The first notarises the build and never blocks. The second, at the end of the pipeline, enforces your policies. The binary is pinned and its checksum verified before it runs.

GitLab CI, from the guide
wisec_notify:
  stage: build
  image: alpine:latest
  before_script:
    - apk add --no-cache git curl
    - curl -fsSLO https://wisec-downloads.s3.fr-par.scw.cloud/wisec-agent-v1.3.0-linux-amd64
    - curl -fsSL https://wisec-downloads.s3.fr-par.scw.cloud/wisec-agent-v1.3.0-linux-amd64.sha256 | sha256sum -c -
    - mv wisec-agent-v1.3.0-linux-amd64 wisec-agent && chmod +x wisec-agent
  script:
    - ./wisec-agent

wisec_gate:
  stage: security
  image: alpine:latest
  before_script:
    - apk add --no-cache git curl
    - curl -fsSLO https://wisec-downloads.s3.fr-par.scw.cloud/wisec-agent-v1.3.0-linux-amd64
    - curl -fsSL https://wisec-downloads.s3.fr-par.scw.cloud/wisec-agent-v1.3.0-linux-amd64.sha256 | sha256sum -c -
    - mv wisec-agent-v1.3.0-linux-amd64 wisec-agent && chmod +x wisec-agent
  script:
    - ./wisec-agent --gate
Your scanners

Semgrep, Trivy, CodeQL: keep them.

Any tool that writes SARIF: its report is signed with the build, and its results join the analysis, the VEX and the posture. Adding a scanner never counts the same vulnerability twice.

What leaves your CI

Stated precisely.

Build metadata, dependencies, the SBOM and your scanners' results. Since agent v1.2.0, secret values and code excerpts are removed before signing. Wisec never clones your repository and has no access to your source control.

Read the agent's code
Around it

The rest of your tooling.

Alerts

Email, Slack, Teams.

A build's anomalies, filtered by severity, where your team reads them.

Authentication

OIDC SSO.

Sign in through your identity provider, with verified domains. Pro plan.

API

Keys you issue.

Read access for a partner you mandate: you issue the key and revoke it when you want. Pro plan.

No. The agent is a single open source binary, added in two steps to any pipeline. Your scanners stay yours: Wisec imports their results.

Book a demoQuick start