SAST Scanning

Find vulnerabilities before they reach production

Pragma Core uses AI agents to analyze every line of source code for security flaws. Full repository scans and incremental diff scans run on every commit, so your team catches issues early and ships with confidence.

Start scanning for free View all features

How it works

Two scan modes, zero blind spots

Comprehensive full scans for baseline coverage. Fast diff scans for every new commit. Both powered by the same AI engine.

Connect a repository

Link GitHub, GitLab, Bitbucket, or Azure DevOps. The platform clones your repo and prepares it for analysis.

AI agent scans the code

The agent reads your source code in chunks, reasons about security context, and identifies real vulnerabilities with structured details.

Findings land in your dashboard

Each finding includes the affected file and function, CVSS score, CWE ID, reproduction steps, and a recommended fix.

Triage and track to resolution

Mark findings as open, acknowledged, fixed, or false positive. Push to Jira with one click. Diff scans keep catching new issues on every push.

Live look

A finding the way your team will read it

Every SAST run produces structured findings with severity, CWE, exact location, a short impact write-up and a remediation suggestion. Here is what one looks like, alongside a sample severity breakdown across a real codebase.

Findings by severity

Sample run, 47 findings

Distribution across a typical mid-size repository after a fresh full scan. Critical and High are the buckets that get auto-ranked to the top of triage.

Sample finding

Critical

CWE-89 CVSS 9.1 Tainted input SQL Injection

app/Http/Controllers/UserController.php:54 in UserController::search()

public function search(Request $request) { $q = $request->input('q'); // User-controlled $q is concatenated directly into raw SQL. // SQLite, MySQL and Postgres drivers all forward this verbatim. return DB::select("SELECT * FROM users WHERE name LIKE '%{$q}%'"); }

Fix: use parameter binding, e.g. DB::select('SELECT * FROM users WHERE name LIKE ?', ['%'.$q.'%']). The agent flagged this as a tainted-input flow from $request->input to a raw DB::select.

Capabilities

Built for real-world application security

Full repository scans

Analyze every file in the codebase from scratch. Ideal for onboarding a new repo or establishing a security baseline after a major release.

Incremental diff scans

Only analyze what changed between commits. Runs automatically on every push, so new vulnerabilities get flagged within minutes of introduction.

Structured findings

Every finding includes the vulnerability name, affected file and function, CVSS score, CWE ID, steps to reproduce, impact assessment, and remediation guidance.

Automatic deduplication

Repeated scans never create duplicate findings. A hash-based dedup system ensures each unique vulnerability appears once, even across multiple scan cycles.

Jira integration

Push any finding to Jira with one click. Custom field mapping, direct links between tickets and findings, and automated issue creation for your dev workflow.

Scheduled scanning

Configure daily, weekly, or monthly scan schedules from the admin panel. Diff scans run on schedule without any manual intervention from your team.

Why it matters

Security testing that keeps up with your developers

Catch issues at the commit level

Traditional SAST tools run nightly or weekly. By then, the developer who introduced the issue has moved on. Diff scans flag problems while the code is still fresh, making fixes faster and cheaper.

No rules to write or maintain

AI agents understand code semantics, not just patterns. They reason about context, data flow, and business logic to find vulnerabilities that regex-based scanners miss entirely.

Works across your entire stack

Connect GitHub, GitLab, Bitbucket, and Azure DevOps repositories in the same workspace. One platform for all your teams, all your languages, all your branches.

From finding to fix in fewer steps

Each finding already includes remediation guidance. Push it to Jira, assign it to the right developer, and track its status through resolution without switching tools.