Introduction
Secu is an automated security analysis platform for engineering teams. It scans repositories for vulnerabilities, leaked secrets, insecure code patterns, and outdated dependencies — then delivers aggregated results through unified dashboards.
What Secu does
When you submit a repository for analysis, Secu runs multiple security scans in parallel:
Secret Detection
Scans commit history and working trees for credentials, API keys, certificates and tokens.
Code Quality (SAST)
Identifies insecure code patterns, injection vectors, and language-specific anti-patterns across multiple languages.
SBOM Generation
Generates a complete state-of-the-art, downloadable inventory of all direct and transitive dependencies.
Vulnerability Analysis (SCA)
Cross-references your dependency tree against vulnerability databases and prioritises findings by real-world exploitability and active threat intelligence, so your team focuses on what matters most.
Dependency Trust Scoring
Evaluates the security posture of every dependency across multiple dimensions — code review practices, branch protection, CI testing, signed releases, and maintenance activity — to give your team a data-driven view of supply chain risk.
Results from all scans are aggregated into a single report, organised by category — secrets, static analysis, vulnerabilities, and dependencies — with detailed findings in each. Everything is accessible at a glance from the web dashboard, alongside an overall security score and downloadable artefacts.
How it fits into your workflow
Scans can be triggered directly from the web dashboard — select a repository, click Start Analysis, and results start appearing within minutes. For automation, a lightweight CLI tool integrates into existing CI/CD pipelines and triggers a full analysis with a single command. Results are available through the REST API for programmatic access or through the web dashboard for manual review.
The platform supports both public and private repositories. Authentication with GitHub is handled through a dedicated integration service, and repository contents are processed in short-lived storage that is cleaned up automatically after each analysis.
Next steps
- Security Scanners — learn about each scanner and what it detects