CI/CD integration
Security scanning in your CI/CD pipeline
SecuProbe scans your application every time you ship. A GitHub Action and a REST API launch the scan, wait for the result and stop the pipeline when a serious vulnerability is found.
Why scan in the pipeline
Most vulnerabilities are introduced by ordinary changes: a new dependency, a header removed during a refactor, a debug file left on the server. A yearly audit finds them months later. A scan in the pipeline finds them on the day they appear, while the developer who made the change still has the context.
Scanning in CI/CD also turns security into a rule that everyone can read. The pipeline either passes or fails, the reason is written in the job, and nobody has to remember to run a tool by hand.
The official GitHub Action
The SecuProbe GitHub Action needs two inputs: an API key stored as a repository secret and the URL to scan. On each run, the action starts a scan, polls until it is complete and writes a summary to the GitHub Actions job page with the SecuScore, the number of vulnerabilities by severity and a link to the full report.
The fail_on_severity input sets the threshold that fails the job: critical, high, medium or none. A team that is starting out can fail on critical findings only, then tighten the rule once the backlog is clear. The action also exposes the scan ID, the score and the report URL as outputs for later steps.
Any other CI with the REST API
Every CI system that can run curl can run SecuProbe. One request to the REST API starts a scan and returns its identifier; a second request reads the status and the count of vulnerabilities by severity. The API documentation includes ready-to-copy pipeline examples that use this pattern.
API keys carry scopes, so a pipeline key can be limited to creating and reading scans. Requests are rate limited per key, and the limits are returned in the response headers.
What a pipeline scan checks
A pipeline scan runs the same modules as a scan launched from the dashboard: security headers, SSL/TLS configuration, exposed sensitive files, DNS and email security, outdated front-end libraries and known CVEs. On a domain whose ownership you have verified, SecuProbe adds active OWASP Top 10 tests such as SQL injection, cross-site scripting, CSRF and CORS misconfiguration.
We recommend pointing the pipeline at a staging environment that mirrors production, and verifying that domain once. Each finding comes with a severity and a fix guide written for developers.
Scheduled scans and alerts
Not every risk arrives with a commit. Certificates expire, new CVEs are published for libraries you already use, and DNS records change. SecuProbe can scan a domain on a schedule and notify you when the score drops or a new vulnerability appears.
Webhooks deliver scan events to your own endpoint, and a Slack integration posts them to a channel, so the result reaches the team where it already works.
Getting started in ten minutes
Create a SecuProbe account, add your domain and verify its ownership. Generate an API key in the dashboard settings and store it as a secret in your CI. Add the GitHub Action or the API calls to your workflow, choose the severity that fails the build, and push. The first report is available as soon as the job completes.
The REST API and the GitHub Action are included in the Pro and Enterprise plans. The free plan lets you try the scanner and read your first score before you automate anything.