Give the scanner context, not permanent control.

Connect the repository, event source, or execution surface a project actually needs. AISEC shows what was linked, when it last delivered an event, and where the resulting scan came from.

Open project integrationsSee available paths
SignalsPush / PRCLI / CIREST
ΛISECprojectverified scope
EvidenceScansIssuesRetests
RepositorySelected GitHub repositories provide exact code context
EventsSigned GitHub, GitLab, and Bitbucket webhooks trigger discovery
ExecutionDashboard, Python, Node.js, CI, and REST API
EvidenceEvery run and issue remains attached to the project

Signals in. Project context. Evidence out.

The integration model is intentionally plain. Events can start work; context makes it more accurate; AISEC records the result in the same project workflow.

01 / Signals in

What changed

  • Push and pull-request events
  • Manual dashboard scan
  • CLI or CI invocation
  • REST API request
02 / Context

What the agent may use

  • Verified project scope
  • Selected repository content
  • Authorized credentials and headers
  • Project documentation and known assets
03 / Evidence out

What your team receives

  • Discovery and scan records
  • Proof-backed issues
  • Evidence and remediation context
  • Retest and audit history

Choose the connection by the job it does.

GitHub App

Link selected repositories to a project so AISEC can recover routes, manifests, dependency versions, and other code context that runtime discovery cannot see.

Repository context

GitHub webhook

Verify signed push and pull-request events, update the last-event state, and queue project discovery when the event is actionable.

Change signal

GitLab webhook

Use a per-project secret to verify GitLab events and trigger the same bounded discovery path.

Change signal

Bitbucket webhook

Use a per-project secret to verify Bitbucket events and trigger project discovery.

Change signal

Python / Node.js CLI

Start and inspect authorized scans from local automation without rebuilding the scanner workflow.

Execution surface

CI pipelines

Use the CLI in GitHub Actions or GitLab CI and apply its configured severity threshold to the job result.

CI gate

REST API / webhooks

Use the authenticated API to work with project state and signed webhooks for event-driven automation.

Custom automation

A connection is not complete until it reports its state.

Connect

An account owner or authorized project member chooses the provider and the project boundary.

The connection appears only inside that project.

Verify

Webhook secrets are shown once. Provider signatures are checked before an event can trigger work.

The integration records its most recent accepted event.

Observe

Repository sync, analyzed commit, integration state, scan source, and errors remain visible instead of failing silently.

The operator can tell whether context is current.

Revoke

Remove the project integration when it is no longer needed. New use requires a new secret or explicit reconnect.

Deliveries stop and the integration disappears from the active list.

No connector should quietly widen scope.

Project controls

  • 01Repository access is limited to repositories selected in the GitHub App installation and linked to the project.
  • 02Integration management is enforced by backend permissions, not by a hidden button.
  • 03Webhook secrets are encrypted at rest and plaintext is shown only at creation or rotation.

Operator checks

  • 01Confirm the repository and project before granting access.
  • 02Paste the one-time secret into the provider immediately and send a test event.
  • 03Review last-event and repository sync state before relying on automation.

Connect one source. Confirm one event.

Start with the project’s repository or delivery webhook. The authenticated integration screen is the source of truth for plan availability.

Open integrations