Every scanner, one queue.
The open-source code security platform.
The open-source CybeDefend Platform scans your repositories, ranks each finding by reachability and drafts the fix.
The riskiest finding comes first.
One list, scored from 0 to 100 on exploitable risk.
Findingscheckout-apiDemo project
| Severity | Finding | Scanner | Priority | Status |
|---|---|---|---|---|
| Critical | AWS access key, verified livesrc/ | Secrets | 97 | Open |
| Critical | Workflow injectionrelease. | CI/CD | 92 | Fix ready |
| High | SQL injectionusers. | SAST | 90 | Fix ready |
| High | CVE-2022-24999 in qs 6.7.0package-lock. | SCA | 86 | Fix ready |
| High | Public S3 bucketmain. | IaC | 81 | Fix ready |
| High | CVE-2023-5363 in openssl 3.1.3-r0api-server:v2. | Container | 71 | Open |
Find it. Fix it. Prove it.
Scanners find, AutoFix fixes, policies and reports prove.
Run it your way.
Start with one repository.
Connect GitHub, GitLab, Bitbucket or Azure DevOps, pick a repository, and the first scan starts.
In detail
Find it. Fix it. Prove it.
Every scanner feeds one list, scored from 0 to 100 on real, exploitable risk.
GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Slack and your IDE. Side by side with the tools you already know.
Scanners find the flaws, triage and AutoFix close them, policies and reports prove it to your auditors.
SAST, SCA, secrets, IaC and CI/CD findings also reach your coding agent, through VibeDefend.
Before you sign up.
Is the platform separate from VibeDefend?
Same data, two surfaces. The platform is the dashboard layer where the scanners (SAST, SCA, IaC, container, secrets, CI/CD), the findings graph, the policies and the compliance reports live. VibeDefend is the agent-time layer that injects the same rules into Claude Code, Cursor, Windsurf and any MCP-compatible client. You can use either independently or both together.
How do I install CybeDefend on my repo?
Sign in at eu.cybedefend.com or us.cybedefend.com, OAuth your GitHub / GitLab / Bitbucket / Azure DevOps org, pick a repo, and the first scan starts. No CI step to add, no agent to deploy. The MCP server ships in two regional endpoints (mcp-eu.cybedefend.com/mcp and mcp-us.cybedefend.com/mcp), you only register the one matching your tenant with your AI coding agent.
Where is my code stored when CybeDefend scans it?
Source is fetched, analysed and the results are stored in the region you pick at signup (EU = Paris, US = Iowa). EU and US tenants are isolated; nothing is replicated between the EU and the US (EU database backups stay in the EU, in Amsterdam). For a standard scan, the source is destroyed with its container when the scan ends, and only findings and metadata are kept. With Cybe Analysis or the Security Champion on, a copy of the code and its git history is kept in that same region, because those features answer from it.
Can I run CybeDefend self-hosted or air-gapped?
Yes. Community, the open-source edition, is the whole platform on your own servers, for free. Enterprise adds on-premise or air-gapped deployment with committed support.
What languages, frameworks and IaC platforms are supported?
SAST: TypeScript / JavaScript, Python, Go, Java / Kotlin, C# / .NET, Ruby, Rust, PHP, plus framework-aware rules for Next.js, NestJS, Django, FastAPI, Spring, Rails, Laravel. IaC: Terraform / OpenTofu, Kubernetes, Helm, CloudFormation, Pulumi, Ansible, CDKTF. Container: any OCI image (Alpine, Debian, Ubuntu, RHEL/UBI base layers, npm, PyPI, Maven, Go, Cargo, NuGet, Composer dependencies). CI/CD: GitHub Actions, GitLab CI, Jenkinsfile.