What is a DevSecOps repository scanner?
A DevSecOps repository scanner analyses your source code and configuration
without executing it, looking for hardcoded secrets, insecure code
patterns (SAST), vulnerable dependencies (SCA), and misconfigured
infrastructure-as-code. Aegis runs 176 such test types and rolls the
results into one posture score.
Do I need to install any tools to use Aegis?
No. Aegis ships a native engine of 119 checks written in pure Python,
so scanning works the moment it boots — on any machine, for any language. The
57 external CLI scanners are optional integrations that deepen results,
not requirements.
Which compliance frameworks does Aegis map findings to?
Every finding maps to OWASP Top 10, CIS Benchmarks,
PCI-DSS v4 and NIST SSDF. Each framework shows per-control
pass/fail status alongside the number of open findings, so you can hand the
report straight to an auditor.
Is my source code safe when I run a scan?
Yes. Aegis performs static analysis only — your repository is cloned
into a temporary directory, inspected, then discarded. Your code is never
executed, and guest scans are never persisted.
Is Aegis free?
Yes. The Free plan covers all 119 built-in checks, unlimited public
repository scans, the posture score, the compliance view and CSV export — at
no cost. Paid plans add private repositories, the CLI integrations, scan
history and PDF reporting.