Your CI/CD pipeline now speaks compliance.
Snyk and Trivy find the vulnerabilities. SonarCloud catches the SAST issues. Nothing in your pipeline tells you which finding breaks SOC 2 CC6.1 or which one will sink your next FedRAMP audit. CVERiskPilot is that layer.
13
Frameworks
SARIF
Native output
Free
Apache-2.0 CLI
5m
Time to first PR check
Built for the engineers who own the pipeline
Drop-in GitHub Action
One workflow file, SARIF lands in the Security tab, criticals block the merge. The same CLI runs as a plain command in GitLab CI, CircleCI or Jenkins; PR comments and Security-tab upload are GitHub-only.
Exit-code gating
--fail-on critical, --fail-on high, --fail-on medium — pick the severity threshold your team enforces and let CI do the rest.
Multi-scanner orchestration
Runs dependency, secrets, and IaC scans in one binary. Results from Trivy, Snyk, Semgrep, Checkov or OWASP ZAP can be uploaded to the platform as SARIF, CSV or JSON.
Compliance verdict on every PR
The Action posts a PR comment with a compliance-impact table naming the affected control IDs, e.g. SOC 2 CC6.8 and NIST 800-53 SI-10 for a SQL injection (CWE-89). No spreadsheet lookup.
Redaction before AI triage
AI triage and remediation requests strip IPs, hostnames, API keys and AWS account IDs before the model call. The CLI's optional AI enrichment runs only against a local model.
Push to ticketing
Push cases to Jira, one at a time or in bulk, or to ServiceNow, with severity, CVSS, EPSS, KEV status and CVE IDs in the ticket. Automation rules for routing are planned.
PR-to-evidence in one workflow
Step 01
Add the action
Paste 10 lines of YAML. uses: github/codeql-action/upload-sarif posts results to GitHub Security tab.
Step 02
Open a PR
Compliance check runs in <30s on a typical Node/Python/Go repo. Findings appear inline.
Step 03
Review in your workspace
With an API key, CLI results appear on the Pipelines page in your workspace. Upload scanner files to create cases for AI triage and review.
Step 04
Auditor consumes evidence
Case decisions are recorded in the hash-chained audit log. Linking pipeline results to their repository, branch and commit is planned, and signing the chain is in progress.
Five minutes from npm install to compliance-gated merges.
The CLI is Apache-2.0 and free forever. A free Starter workspace adds AI triage, the dashboard, the audit chain, and the full 13-framework catalog during the alpha.