Fits your delivery process
Choose the pipelines, triggers, and repositories to cover. winfunc runs as a step in the workflow you already maintain.
CI/CD
AvailableSecurity checks inside the pipeline you already run.
Run winfunc from GitHub Actions, Jenkins, or CircleCI. Findings flow back to the pull request and the workspace, and your team decides what blocks a merge.
- acme
- /billing-api
- /Scans
- /#1842
Gate failed
- Dependencies412/412
- Preparingdone
- Reviewing changes6/6
- Validating1/1
- Building reportdone
Activity 51m 47s
14:02:11deps412 packages resolved, no new advisories
14:02:19prepDiff scoped to 6 files in feat/export
14:03:02revwTracing req.query.format through export.ts
14:03:47valdMissing role check reproduced with a member session
14:03:58rprt1 high finding. Policy blocks merge on high.
Checks · PR #2481
- build1m 12s
- test3m 40s
- winfunc / security1 high · merge blocked
What it does
Capabilities.
- GitHub Actions workflow via winfunc-action
- Jenkins pipeline scans with configurable thresholds
- CircleCI workflow scans
- Findings reported back to the pull request
- Team-controlled policies for reporting or blocking
- Repository and service scoping for monorepos
- Results mirrored in the winfunc workspace
- Alerts to Slack and Microsoft Teams, issues to Jira
Why it matters
Built for decisions, not queues.
Your policy, your gates
Decide whether findings report or block, set thresholds by severity, and keep exceptions under your team's control.
Feedback where developers look
Results return to the pull request with the evidence attached, and land in Jira, Slack, or Teams when your team wants them there.
Monorepos welcome
Scope reviews by repository, service, or package boundary so each team sees the findings that belong to it.
Continue the evaluation
Start with one repository
Bring us your hardest codebase.
We'll bring the proof.
Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.