Garth / Products / GScan
GScan GScan Security & Compliance

Find it before it
becomes an incident.

Most scanners check one thing. GScan runs six security analyses and your quality checks in a single pass, over your whole repository, then hands back every finding scored, standards-tagged, and ready to fix, with the trend since your last scan.

Start a pilot See a scan report
6+2Security & quality scans, one pass
CVSSEvery finding scored, CWE & OWASP tagged
4Git providers: GitHub, GitLab, Bitbucket, Azure
Secrets · SCA · SAST · IaC · SBOM · End-of-Life · grounded on GKS
Scan Result Reportmain @ a1b7c3d · just now
Action required
Security Analysis
SA▲1
2
Secrets
SCA▼3
14
Dependencies
SAST▼2
5
Code
IaC±0
3
Infra config
SBOM▲6
128
Components
EOL▲1
4
End-of-life
34,812 lines · 6 languages · vs. previous scan

Six scans, one pass

Secrets, dependencies, code, infrastructure, SBOM, and end-of-life, plus complexity and duplication. One branch scan. One report.

No tool sprawl

Findings you can act on

Every issue carries a CWE, OWASP category, and CVSS score, a code snippet, remediation, and a deep-link to the exact lines.

Scored and sourced

Trend-aware, scan over scan

Each category is compared to your last scan, so you see whether risk is climbing or falling, commit by commit.

Regression, caught

Governed by design

Reads through GKS, writes back only through your keys. Cloud, VPC, or on-prem. Your source never leaves your boundary.

Your data stays yours
A real scan

This is what a scan hands back.

Not a raw tool dump. One report: six security analyses and your quality checks, each finding scored, tagged, and ready to fix, with the deltas since your last scan.

Every finding is scored, tagged, and sourced.

GScan doesn't just say "possible issue." Each finding carries a severity and CVSS score, the CWE and OWASP category, the exact file and lines, a code snippet, and remediation you can apply, with a deep-link straight to the source.

Standards-tagged

CWE, OWASP, and a CVSS score on every security finding, so it maps to the frameworks your auditors already use.

Remediation, not just detection

Each finding ships with a concrete fix and reference links, not a bare rule ID to go and google.

Deep-linked to the line

One click to the exact lines in GitHub, GitLab, Bitbucket, or Azure DevOps.

One scan covers
Secrets Dependency CVEs Code (SAST) IaC misconfig SBOM & licenses End-of-life Complexity Duplication
6+2
analyses in a single branch pass. One report, not eight separate dashboards.
Scan Result ReportBranch main · commit a1b7c3d
Action required
Security Analysis
SA▲1
2
Secrets
2
SCA▼3
14
Dependencies
146
SAST▼2
5
Code
23
IaC±0
3
Infra config
21
SBOM▲6
128
Components
3 copyleft
EOL▲1
4
End-of-life
13
Code Quality
CC±0
37
Functions over threshold
DUP▼2
9
Duplicate groups
HIGHSecrets · CWE-798config/settings.py:14
Hardcoded API key committed to source
A live credential is stored as a module-level constant. CVSS 8.6. Anyone with repo access, or anyone the repo is later exposed to, inherits the key.
RemediationRotate the key immediately, then move it to a secrets manager and load it from the environment at runtime.
View lines 14–16 on GitHub
34,812 lines · 6 languages · 28 findings · export as HTML
Beyond your own code

You don't just ship your code. You ship your supply chain.

GScan inventories every dependency, resolves its license and copyleft exposure, and flags what's vulnerable or end-of-life, the risk that lives in code you never wrote.

Software Bill of Materials
Python · 61JS · 48Go · 19
requests2.31.0 · pip
Apache-2.0permissive
cryptography41.0.7 · pip
BSD / ApacheCVE · SCA
paramiko2.7.2 · pip
LGPL-2.1end-of-life
chardet4.0.0 · pip
LGPL-2.1weak copyleft
pyicu2.8 · pip
GPL-3.0strong copyleft
128
components inventoried across 4 languages, each with a PURL and CPE
3
strong-copyleft licenses flagged with a policy note for legal review
4
dependencies past end-of-life, no longer receiving security fixes
Not a one-time snapshot

It tells you if you're getting better or worse.

Every scan is compared to the last. Findings carry deltas, mitigations are time-boxed, and false positives stay dismissed, so the report reflects real, current risk, not noise you already triaged.

Change since scan #487 days ago
SCA
Dependencies3 vulns patched, 1 new advisory
14−3
SAST
Code2 findings fixed in this branch
5−2
SA
Secrets1 new hardcoded key introduced
2+1
IaC
Infra configno change
30
EOL
End-of-life1 dependency newly past support
4+1
Mitigations & false positives
MITIGATEDSCA · opensslexpires in 43 days
CVE-2023-5678 accepted for this release
Reason: not reachable from our code paths; fix scheduled for the v4 upgrade. Approved by @security-lead.
FALSE POSITIVESAST · test fixture
Sample token in a test fixture
Reason: non-live placeholder used by the auth test suite. Dismissed, and it stays dismissed on every future scan.
Mitigate Mark false positive
Scheduled scans Run GScan on your cadence, weekly, bi-weekly, or monthly, so the trend keeps updating even when nobody kicks off a scan.
The economics of security

Catch it in a scan, not in a breach.

A vulnerability caught in a scheduled scan costs a fix. The same vulnerability caught in production costs an incident, a disclosure, and trust you don't get back.

Cost to resolve the same vulnerabilityIllustrative · based on published defect-escape multiples
Caught in a scan
baseline
Caught in production
many times more
Built into every scan
0
Security analyses in one pass
CWE·CVSS
Every finding, standards-tagged
1
Report, not eight dashboards

GScan surfaces the risk. Your team decides what ships.

How it works

Every scan runs through the governed boundary.

GScan never touches your systems directly. It reads through GKS, the governed knowledge layer you control, and writes findings back only through your keys.

1

Asks GKS

On a scan, GScan requests what it needs: your branch source, dependency manifests, and infrastructure config.

2

Policy & guardrail check

GKS checks policy at intake, releasing only what this scan is authorized to read.

3

Pulls only what it scans

Scoped context: the branch, its dependencies, and IaC, nothing beyond it, for the analyses you enabled.

4

Returns findings

A scored, tagged report lands in Garth, written back to your environment through your key.

Configured in Garth Universe

Your repos, your rules. Set once, run on every scan.

Garth Universe is the control plane. Choose which repos GScan watches, pick which analyses run, scope files in or out, set the schedule, and route it through your own model keys.

universe.heygarth.ai / agents / repository-review
Repository Review Agent
Active and monitoring enabled repositories
Scheduled scansGScan re-scans each enabled repo on your cadence. Currently weekly, Sundays at 02:00 UTC. Or trigger a scan on any branch, on demand.
Code Security6 active
SA
Secrets AnalysisDetect hardcoded secrets, API keys, and passwords
ON
SCA
Software CompositionIdentify vulnerabilities in dependencies
ON
SAST
Static AnalysisFind security vulnerabilities in code
ON
IaC
Infrastructure as CodeScan IaC files for security misconfigurations
ON
SBOM
Bill of MaterialsSupply-chain inventory with license visibility
ON
EOL
End of LifeFlag components at or nearing end-of-life
ON
Code Quality2 active
CC
Code ComplexityCyclomatic and cognitive complexity
ON
DUP
Duplicate CodeIdentify duplication and suggest refactoring
ON
Files to exclude
*.test.pyvendor/**node_modules/***.min.js
Repositories
payments-servicePythonenabled
web-checkoutTypeScriptenabled
infra-terraformHCLenabled
Providers & routing
GitHubGitLabBitbucketAzure DevOpsBYOK · connected
~5 min setup Connect a repo, pick a branch, and GScan runs its first scan out of the box. Every analysis and schedule after that is a click away in Universe.
Data Governance

Your source stays yours.

Agents never touch your systems directly. Everything reads through GKS, the governed boundary you control, and every action writes back only through your keys.

01

You choose what connects

GKS ingests only the sources you authorize. Nothing you have not connected ever enters.

02

Only what the scan needs

Each scan gets the exact source, dependencies, and config it needs, filtered at intake, and nothing beyond it.

03

Guardrails at the boundary

Agents read from GKS, never your host systems. Misuse stops at the boundary, not inside your stack.

04

Every action needs your keys

When an agent writes findings back to a system, it goes through credentials you provision, scope, and revoke at will.

GKS runs
Garth Cloud
In your VPC
On-prem

GKS runs in Garth Cloud. Your systems stream in over an encrypted, governed channel. Fastest to start, nothing to host.

Where GScan stands apart

Everyone owns a slice. Garth owns the layer.

Point tools each read one signal. GScan grounds security and quality on the same shared brain as review, release, and ROI, so it sees what none of them can.

CapabilityGScanSnykSemgrepGitHub AS
Security & quality in one branch pass✓~~~
Secrets + SCA + SAST + IaC + SBOM + EOL, unified✓~~~
SBOM with license & copyleft policy✓~–~
Scan-over-scan trend deltas per category✓~––
Time-boxed mitigations with audit trail✓~–~
Governed data boundary · VPC / on-prem✓~~–
One shared brain across review, security & release✓–––
✓ Full~ Partial– None

The wedge is competitive. The platform is not.

The number leaders can defend

One scanner instead of six line items.

Most teams pay for a secrets tool, an SCA tool, a SAST tool, an IaC tool, and an SBOM tool, then pay engineers to reconcile them. Move the sliders to your team and see the return.

Your team

25
4
$24
8 h
$16,000

Your return with GScan

$120K
estimated annual value for your team
Current tools + reconciliation / mo$10,600
GScan cost (25 devs × $10)$250
Net monthly savings$10,000
Tools consolidated4 → 1

Illustrative model. Assumes GScan replaces your standalone scanning tools and absorbs ~70% of the time spent reconciling their separate reports into one. GScan priced at the $10/dev blended Standard rate. Security-tooling scope only; real value is typically higher across the wider workflow.

Pricing

Priced per developer, billed on who's active.

GScan bills on active developers, a contributor active in the trailing 30 days. Dormant seats are never charged. Discounted when bundled into the Garth Suite.

Most teams start here
Standard
$8–12/ active dev / mo
Billed on active developers · annual billing available
  • Six security scans: secrets, SCA, SAST, IaC, SBOM, EOL
  • Code-quality checks: complexity & duplication
  • CWE / OWASP / CVSS findings with remediation
  • Scan-over-scan trends & mitigation workflow
  • Scheduled scans & standalone HTML reports
  • GitHub, GitLab, Bitbucket & Azure DevOps
Start a pilot
Enterprise
$15–25/ active dev / mo
Everything in Standard, plus:
  • Custom policy packs & rules
  • Audit exports & compliance reporting
  • SSO / SAML, RBAC & audit logs
  • Private model routing · BYOK
  • VPC & on-prem deployment
  • Priority support with SLA
Contact sales
Design-partner program

Building with the first cohort? Design-partner rates, plus a 3-week all-features trial with your own key. Bring your own model key and the price drops further.

Every plan includes GKS (the knowledge backbone), GAssist, and G-IDE. Bundle GScan into the Garth Suite and it always prices below licensing it apart.

Who it's for

Built for teams that ship faster than they can audit.

Security-conscious startups

  • One scanner instead of a stack of tools
  • Secrets and CVEs caught before they ship
  • No dedicated security hire to get started

Regulated & compliance teams

  • Findings mapped to CWE, OWASP & CVSS
  • SBOM and license exposure for audits
  • Audit-ready standalone HTML exports

Platform & DevSecOps

  • Scheduled scans across every repo
  • Trend tracking to prove risk is falling
  • Policy packs enforced centrally

Security-sensitive orgs

  • Governed data boundary through GKS
  • VPC or fully on-prem deployment
  • Source never leaves your perimeter
Get started

Your repos have vulnerabilities you haven't scanned for yet.

Start a 3-week, all-features pilot with your own model key: GScan running six security analyses and your quality checks across your real repositories, in one report.

Book a Demo See pricing