Skip to content
In development

DevSecOps Pipeline Security — In Development | Bachao.AI

Pipeline security we are building. Nothing scans yet.

You can register a repository and wire a signed webhook today. The scanners behind it are not built, so no findings are produced — and we will not invent any.

Talk to us about a pilot →What exists today
In developmentRepository registration + signed webhookNo scanners yetPilot engagements only

What we are building

Five scan types on the roadmap, and the one piece that exists in the product today.

Static analysis

Planned: analyse the source on each push for injection, authentication and cryptography mistakes.

Dependency scanning

Planned: match your dependency tree against public CVE data, with license posture reported alongside it.

Container scanning

Planned: scan built images for OS-level CVEs and for credentials baked into a layer.

Secret detection

Planned: detect credentials across the working tree and the commit history, not only the latest diff.

Infrastructure-as-code checks

Planned: check Terraform, CloudFormation and Kubernetes manifests for insecure defaults before they are applied.

Repository registration — built today

Register a repository, receive a per-project webhook secret, and point your CI at the webhook. Deliveries are authenticated with a constant-time secret comparison. Because no scanner sits behind it, the endpoint answers that the engine is unavailable rather than returning a verdict.

How it will work

Four stages. Only the first one exists today.

1CONNECT

Built today: register the repository and point your CI at the webhook. Every delivery is verified against that project's own secret before anything is recorded.

2SCAN

Planned: run the scanners against the commit. This is the piece that does not exist — there is no scanner in the product today.

3TRIAGE

Planned: collapse duplicates across scan types and rank what is left by what is actually reachable in your application.

4REPORT

Planned: return the result to the pipeline that asked for it, so the gate is a decision your CI can act on.

Shift-left security: A defect caught at the pull request is far cheaper to fix than the same defect found after release. That is the argument for pipeline security and the reason this product is on our roadmap — our pipeline does not catch anything yet.

Technical FAQ

The questions your engineering lead will ask about DevSecOps.

What is DevSecOps and why do Indian startups need it?

DevSecOps means moving security checks into the pipeline that already builds and ships your code, so a problem is caught by the engineer who wrote it rather than by an auditor months later. For a small team it matters more, not less: there is no separate security function to catch what the pipeline misses.

What can I actually use today?

Registering a repository and wiring a webhook. That is the whole of it. The webhook verifies your project's secret and then reports that the scanning engine is not enabled, because the scanners are not built. It will never return a finding count that no scanner produced.

Which CI/CD platforms does this work with?

The webhook is plain HTTP with a shared secret, so any CI system that can make a POST request can call it. We publish one worked example — a GitHub Actions snippet shown in the dashboard once you register a project. We do not ship plugins or templates for other platforms, and we have no GitHub, GitLab or Bitbucket API client, so we cannot open pull requests, comment on them, or block a merge.

Does our source code leave our infrastructure?

Nothing leaves it today beyond the webhook payload you choose to send us: branch, commit SHA and event type. When scanners land, the design intent is that they run inside your own runner and report metadata only. We will describe exactly what crosses the boundary before you run anything.

Can this evidence ISO 27001 or CERT-In secure-development requirements?

Not yet. Those frameworks do expect vulnerability scanning inside the development lifecycle, but this product cannot evidence that for you because it does not scan. Our VAPT engagements are the part of Bachao.AI that produces audit-grade findings and reports today.

CI/CD integrations

What the webhook does today

Registering a repository in the dashboard creates a project with its own webhook secret. Your CI posts the branch, commit SHA and event type to the webhook, sending the secret in an x-webhook-secret header; the handler looks the project up by id and compares the secret in constant time before it will do anything at all. Behind that check there is no scanner, so the endpoint reports that the engine is unavailable. That is deliberate: the alternative — returning a plausible-looking finding count — is how a customer ends up treating an invented number as a release gate.

Calling it from your pipeline

The integration is one HTTP call, so it fits any runner: GitHub Actions, GitLab CI, Jenkins, Bitbucket Pipelines or a shell script on a box you own. The dashboard shows a GitHub Actions example once a project exists; for anything else, the same curl line works with the secret pinned as a masked CI variable. There is no agent to install and no inbound network access required. We do not ship a plugin for any platform, and we do not have an API client for any code host, so nothing in this product can comment on a pull request or prevent a merge.

Where pipeline security sits against DPDP and CERT-In

The Digital Personal Data Protection Act 2023 requires data fiduciaries to implement reasonable security safeguards, and CERT-In's directives expect vulnerability management inside the development lifecycle. Catching a data-handling defect before it merges is a clean way to demonstrate that, which is why we are building toward it. Today this product produces no findings and therefore no evidence. If you need evidence now, that is what our VAPT engagement produces: a scoped test, validated findings and a report a reviewer can read.

Self-hosted and VPN-only GitLab

Indian BFSI and government-adjacent teams often run self-hosted GitLab behind a VPN, which usually breaks integrations that expect an inbound connection. This one does not need one: the runner makes an outbound call, so the only requirement is that the runner can reach us. For fully air-gapped environments, write to ceo@bachao.ai and we will tell you honestly whether what you need is on the roadmap.

Explore more products

Bachao.AI covers your entire security surface — from code to cloud to compliance.

AI VAPT Scanner

Automated penetration testing for web apps and APIs. Results in under 2 hours.

Learn more →

API Security Testing

OWASP API Top 10 coverage for REST and GraphQL endpoints.

Learn more →

Cloud Security Audit

AWS, Azure & GCP misconfiguration detection with DPDP mapping.

Learn more →
  • ISO 27001
    Certified
  • ISO 9001
    Certified
  • IAF — International Accreditation Forum
    Accredited
  • AICPA SOC 2 Type I and Type II
    In process
  • GDPR
    In process

Want pipeline security when it ships?

We are building it now. Tell us what your pipeline looks like and we will scope a pilot — and be straight with you about what does not exist yet.

Talk to us about a pilot →Email us
Find your vulnerabilitiesStart free scan →