Loading SOVA...
Loading SOVA...
Embed security directly into your development pipeline. SOVA integrates with GitHub, GitLab, and Azure DevOps to enforce security policies, block vulnerable deployments, and generate SARIF-compatible reports — all without slowing down your developers.
The Problem
Attackers don't need to break into your app if they can compromise your build pipeline. CI/CD is the chokepoint where all code becomes production software — and it's often the least secured.
3 of 5
Major attacks target CI/CD
SolarWinds, Codecov, and 3CX all compromised build pipelines. Attackers inject malicious code where it's trusted most — your deployment infrastructure.
0
Security gates in most pipelines
Most CI/CD pipelines run tests but have zero security gates. A vulnerability scan that doesn't block deployment is just a notification you'll ignore.
14%
Of breaches from supply chain
Supply chain compromises now account for 14% of breaches (Verizon DBIR). CI/CD is the primary attack vector for supply chain attacks.
How It Works
Trigger
Git Push / PR / Webhook
GatewayEngine
Policy DSL Evaluation
rule: block if severity >= critical
rule: require sbom_generated == true
Decision: FAIL
CVE-2024-3094 (CVSS 10.0)
Output
SARIF Report + PR Comment + SLA Timer
Native GitHub App integration with webhook-driven scanning on push and pull_request events. Results post directly as PR checks and code annotations.
// Webhook events: push, pull_request
{
"action": "opened",
"pull_request": {
"number": 247,
"title": "feat: add payment gateway integration",
"head": { "ref": "feature/payments" }
}
}Pipeline integration via .gitlab-ci.yml. SOVA runs as a pipeline job, scanning merge requests and publishing results to the GitLab Security Dashboard.
# .gitlab-ci.yml
sova-security-scan:
stage: test
image: securenexus/sova-cli:latest
script:
- sova scan --format cyclonedx
- sova policy check --config .sova-policy.yaml
artifacts:
reports:
sast: gl-sast-report.json
rules:
- if: $CI_MERGE_REQUEST_IIDAzure Pipelines task extension with build and release pipeline support. SARIF output integrates with Azure DevOps code scanning.
# azure-pipelines.yml
steps:
- task: SOVASecurityScan@2
inputs:
scanType: 'full'
policyFile: '.sova-policy.yaml'
failOnViolation: true
outputFormat: 'sarif'
- task: PublishBuildArtifacts@1
inputs:
pathToPublish: '$(Build.ArtifactStagingDirectory)/sova-report.sarif'
artifactName: 'SecurityScanResults'{
"name": "production-release-policy",
"rules": [
{
"type": "max_severity",
"value": "medium",
"action": "block"
},
{
"type": "no_critical_cves",
"action": "block"
},
{
"type": "license_allowlist",
"licenses": ["MIT", "Apache-2.0", "BSD-3-Clause", "ISC"],
"action": "warn"
},
{
"type": "sbom_required",
"format": "cyclonedx",
"action": "block"
},
{
"type": "reachability_threshold",
"min_confidence": 50,
"action": "block"
}
]
}Blocks the pipeline if any vulnerability exceeds the specified severity level. Set to 'medium' means any high or critical finding will prevent deployment.
Hard block on any critical CVE. No exceptions — if a critical vulnerability is detected in any dependency, the merge is blocked until remediated or patched.
Warns when a dependency uses a license not in the approved list. MIT, Apache-2.0, BSD-3-Clause, and ISC are allowed. Copyleft licenses like GPL trigger a warning for legal review.
Blocks deployment unless a valid CycloneDX SBOM has been generated for the build. Ensures every release has a complete software bill of materials for audit and compliance.
Blocks if any vulnerability has reachability confidence above 50%. Uses SOVA's static analysis to determine if vulnerable code paths are actually invoked at runtime.
SOVA posts scan results directly as a GitHub PR comment. Developers see exactly what was found, what blocks the merge, and where to find the full report.
SARIF (Static Analysis Results Interchange Format) is the OASIS standard for expressing static analysis results. SOVA generates SARIF 2.1.0 compliant reports compatible with GitHub Code Scanning, GitLab SAST, and Azure DevOps.
{
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
"version": "2.1.0",
"runs": [{
"tool": {
"driver": {
"name": "SOVA",
"version": "2.4.1",
"informationUri": "https://securenexus.ai"
}
},
"results": [{
"ruleId": "CVE-2024-21538",
"level": "error",
"message": {
"text": "Denial of Service in [email protected]"
},
"locations": [{
"physicalLocation": {
"artifactLocation": { "uri": "package-lock.json" },
"region": { "startLine": 1847 }
}
}]
}]
}]
}SARIF reports upload directly to GitHub Code Scanning via the code-scanning/upload-sarif API. Vulnerabilities appear as code annotations with severity, CWE references, and fix suggestions in the Security tab.
SOVA converts SARIF findings to GitLab's SAST report format. Results surface in the GitLab Security Dashboard and merge request widgets for inline developer review.
SARIF results publish as build artifacts and integrate with Azure DevOps Advanced Security. Findings appear in the pipeline run summary and can trigger work item creation.
SARIF reports are viewable in VS Code (SARIF Viewer extension), IntelliJ, and other IDEs. Developers see security findings inline while coding, before they even commit.
Total pipeline scans executed across all repositories and branches. Includes push events, pull request scans, and scheduled compliance checks.
Average time from vulnerability detection to remediation across all severity levels. Critical findings average 18 hours; high findings average 3.1 days.
Percentage of pipeline runs that pass all configured policy gates. Up from 87.3% last quarter, driven by automated fix suggestions and developer training.
Deployments blocked this month due to policy violations. 14 were critical CVEs, 6 were missing SBOMs, and 3 were license compliance failures.
Block vulnerable code from reaching production. Integrate SOVA into GitHub, GitLab, and Azure DevOps in minutes.