Verdict Runtime integrations

Verdict Runtime from the IDE to production: pull request checks, CI, ticketing, SIEM and WAF integrations.

Integrations

From the first keystroke to production

Verdict Runtime plugs into the tools your developers already use. Issues are caught where they are cheapest to fix, and watched after they ship.

38 seconds, no sound: one pull request on a demo app, from the editor to a safe merge. The findings, PR comment, fix prompt, AI assistant reply and diff are real tool output; the editor and GitHub screens are re-created.

  1. 01
    Code

    In the editor

    Vulnerable code and leaked secrets flagged on save, before the commit.

    VS CodeEarly access
  2. 02
    Pull request

    On every PR

    One comment with only the new issues, and a merge gate at the severity you set.

    GitHubGitLab soon
  3. 03
    CI pipeline

    In the build

    Fail the build on new high-severity findings. Results land in GitHub's Security tab.

    GitHub ActionsAny CIDocker
  4. 04
    Staging

    Against the running app

    Scheduled live tests and pentests, only on targets you approved in writing.

    NightlyScoped
  5. 05
    Production

    When it's attacked

    A Slack or pager alert when your WAF sees an attack on a weakness we found.

    SlackWebhookJira soon
verdict-runtimecommented on pull request #418 Merge blocked
2 new findings in this pull request
Policy gate: 1 blocked · 1 warned · 0 allowed
High
SQL injection: request input reaches a raw query
api/orders.py:88
Medium
State-changing route without CSRF protection
web/routes/settings.js:41
Fix prompt ready for your AI coding assistant · 37 existing findings elsewhere not repeated

Illustrative example of a pull-request comment.

Reviews developers actually read

NEW ONLY

Only what this change introduced

Existing debt never floods the review, and moved lines aren't reported again.

NO SILENT PASS

A failed scan is never green

If an engine crashes, the check says inconclusive instead of passing.

FORK-SAFE

Safe on outside contributions

Pull requests from forks run with a read-only token.

AI FIX

Fix it with your coding assistant

One click copies a fix prompt for tools like Claude Code, without sending your source code.

Everything you'd expect from a code scanner, built in

The features teams compare scanners on are all included, before the live testing even starts.

  • Automatic fix pull requests for vulnerable dependencies
  • Container image scanning, with base-image upgrade fixes
  • Infrastructure as code: Terraform, Kubernetes, Dockerfiles
  • Secrets detection, with an optional check if a key is still live
  • Open-source license compliance
  • Signed SBOM, with VEX exploitability statements
  • Priority by real-world exploitation: EPSS and CISA KEV
  • CI/CD workflow security for GitHub Actions
  • Cloud and Kubernetes posture checks
  • Ignore rules, baselines and severity gates
  • Custom rules for your own code patterns
  • Upgrade notes: breaking changes before you bump a package

Get your first verdict free

One repository, one report, no obligation: the findings, the evidence behind each one, the fixes we can prepare, and an honest note on what we couldn't check.

Request a free assessment See a sample report Reply within two business days.
We never scan first. Nothing is tested until you've named the target in writing and confirmed you're authorised to have it tested.