Security that lives where the code lives
If you're running platform engineering or DevOps, you've probably had this conversation: security wants a tool installed in CI. The tool needs maintenance. The findings go to a separate dashboard nobody on the engineering team opens. Six months later, you're the one being asked why the alerts piled up unread.
Kolega is built to avoid that pattern. Security runs in the pipeline you already maintain, findings appear where engineers already work, and there's no extra surface area for you to own.
What “fits in the pipeline” actually means
Most security tools say they integrate with CI. What they mean is “we have a GitHub Action you can install.” That's the easy part. The hard part is what happens after.
- Findings go to a separate dashboard, so engineers have to context-switch
- Triage requires logging into a third tool
- Fixes need manual handoff back to the dev who wrote the code
- The CI job adds 5 minutes to every build
- You spend time tuning what blocks vs warns
Kolega's approach is different. Scans run on PR open, findings post as inline PR comments in the same review surface your engineers already use, and autofix PRs are opened directly into the same workflow. No separate dashboard required for daily use (one exists for prioritisation, but engineers can ignore it).
How the pipeline integration works
Three things happen on every PR.
- 01
Scan runs in an isolated container
We clone the repo into an ephemeral environment, run semantic analysis, destroy the container when done. Typical scan completes in 1–3 minutes. Code is never stored at rest.
Trust Center - 02
Findings post inline
Findings appear as comments on the PR with the specific file, line, data flow, and explanation. Engineers see them in the same UI they review code in. No tab-switching, no separate alerts.
- 03
Autofix opens a PR (optional)
For findings where a clean fix is possible, Kolega can open a PR back into your branch with the fix applied. Each autofix PR includes the patch and a regression test that proves the vulnerability is closed.
What you don't have to maintain
No CI config files
OAuth in once, scan runs automatically on every PR.
No separate runners to manage
Cloud-hosted by default. Self-hosted runners available on Enterprise for teams that need code to never leave their infrastructure.
No tuning rules
The engine understands code semantics rather than matching patterns, so there's no rule library to maintain or signature database to update.
No noise management
Findings are real by default. You're not spending Mondays triaging false positives.
Where it fits in your stack
Kolega slots in as the security layer of an otherwise normal pipeline.
| Stage | Existing tool | Kolega |
|---|---|---|
| Build | GitHub Actions / GitLab CI / Azure Pipelines | Runs on PR open, parallel to build |
| Test | Jest / pytest / your runner | Independent — doesn't block test runs |
| Quality gates | SonarQube / linters | Independent — doesn't conflict |
| Security | SAST tool of choice | Replaces or complements |
| Dependency scan | Dependabot / Renovate | Independent — Kolega doesn't do SCA |
| Deploy | Your CD pipeline | Untouched |
We don't replace your CI provider, your test framework, your quality gates, or your CD tooling. We slot in as the SAST layer specifically.
Connect via OAuth in under 3 minutes
GitHub
OAuth, scans on PR open, findings as PR comments.
GitLab
Same flow, merge request comments. Self-hosted GitLab supported.
Azure DevOps
Pull request scans, inline comments on changes.
What about secrets and dependencies?
A common question from platform engineers. Kolega handles:
Secret detection in code
YesHardcoded API keys, exposed credentials, sensitive data in commits.
Dependency scanning (SCA)
Coming soonFor now, run Dependabot or Renovate alongside Kolega.
Container scanning
Not our scopeUse Trivy or your container registry's built-in scanner.
IaC scanning
Not our scopeUse Checkov or similar.
We're SAST plus secrets. If you need the rest, run them alongside us.
See the pipeline integration yourself
The fastest way to see what this looks like in practice is to connect a real repo and open a PR. Findings appear within 1–3 minutes.
No credit card required. 7-day Pro trial. Drops to a free tier afterwards.