Home / Integrations
Integrations
Connects to what you already run.
A short list, honestly labelled. What works today is under today. Everything else carries a date, or the word Later.
Pipeline
Scan on merge, fail the build on new criticals
Call the API from your pipeline, poll for the result, and fail the build when a scan introduces new findings at or above a severity you choose. A GitHub Action template ships in the repository. The same two endpoints work from anything that can make an HTTP request, which is how teams on other runners do it today. A GitLab template, and hardening for both, lands 25 November.
- name: Cyberlop scan
run: |
SCAN=$(curl -sf -X POST "$CYBERLOP_URL/api/ci/scan" \
-H "authorization: Bearer $CYBERLOP_TOKEN" \
-H 'content-type: application/json' \
-d '{"profileName":"nightly-full","commitSha":"${{ github.sha }}"}' | jq -r .scanId)
curl -sf "$CYBERLOP_URL/api/ci/gate/$SCAN" \
-H "authorization: Bearer $CYBERLOP_TOKEN" | jq -e '.pass'Today
What connects right now
CI gate
Two endpoints and a GitHub Action template you paste into a workflow. The gate compares against the previous scan of the same target, so it fires on new findings rather than on the standing backlog.
Git repositories
GitHub and GitLab cloned over HTTPS with a scoped token you supply once, at the commit you name. Read-only, for the length of one scan.
Okta single sign-on
OIDC configured per organisation, with an option to require a bound subject. Okta is the only identity provider today.
Azure Key Vault
Target credentials resolved at launch instead of stored, so nothing sensitive persists in our database. Azure Key Vault is the only vault backend we support.
API tokens and export
Scoped tokens for machine access to what the console does, findings out as data, and branded HTML or PDF reports with secrets redacted.
Your own AI key
Every tier runs on your provider key. Your contract, your data-processing terms, your bill, and the per-scan cost recorded against the target.
Issue tracking
How it actually works today
There is no Jira or GitHub Issues integration. On a finding there is a text field: paste the ticket reference and it travels with the finding through triage, export and the report, so the two records point at each other. That is the whole of it.
Nothing is created in your tracker, nothing is read back, and closing the ticket does not close the finding. The finding closes when the same exploit is replayed and fails. Two-way sync is on the list and is not dated, so it is labelled Later below rather than described as if it were working.
Not yet
Dated, and Later
Exploit-proof export
Request, response, screenshots and source location. The proof behind a confirmed finding, exported as one bundle you can attach to a ticket.
Notifications per organisation
Scan completion and new critical findings routed to the destination each organisation chooses, plus transactional email from the platform.
GitLab CI, and gate hardening
A template for GitLab pipelines alongside the GitHub Action, and hardening of the gate behaviour on both.
Native Jira and GitHub Issues sync
Creating and closing tickets from a finding, with status flowing both ways. Not built, not dated. Today you paste a reference by hand.
Single sign-on beyond Okta
Entra ID, SAML and generic OIDC. If your organisation is standardised on any of those, we are not ready for you yet.
Self-serve signup and billing
There is no signup form. Every account is opened by hand, which is honest at our size and will not scale.
At a glance
Everything that plugs in today.
Repositories and pipelines, one vault backend, one identity provider, the agent you run yourself, and an API for whatever is left.
Wire it into one pipeline and see.
Name the runner you build on and what your team uses for tickets. We will show you the gate firing on a merge, and say plainly which of the items above you would be waiting on.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.