Catch security issues in your code and cloud before they ship

For code, Prasovi runs gitleaks (hardcoded secrets), semgrep (static analysis for insecure code patterns), and trivy (known vulnerabilities in dependencies). For cloud infrastructure, it runs Prowler to check your Azure, AWS, and GCP accounts against common security best practices.

GitLab, GitHub, and Azure DevOps for code scanning — including self-hosted GitLab and GitHub Enterprise Server. Azure, AWS, and GCP for cloud infrastructure scanning.

No. When you scan a repository, Prasovi clones it into a temporary directory, runs the scanners, and deletes the clone as soon as the scan finishes. We keep the findings, not your code.

Every token and credential you connect is encrypted at rest before it's stored, and only decrypted in memory for the scan you explicitly trigger.

No — everything runs on our servers. Connect an account and click Run Scan.

Not yet — scans run on demand today, triggered by you from the dashboard. Scheduled scanning is on our roadmap.

Yes — both self-hosted GitLab and GitHub Enterprise Server are supported alongside their cloud-hosted versions. Enter your instance's URL alongside your token when connecting; its certificate must be one your server already trusts.

Yes — connect your kubeconfig (the same file kubectl uses) and pick a context if it has more than one. Scanning is read-only: it runs vulnerability scanning only, never misconfiguration, secret, or RBAC scanning, and nothing is ever deployed into your cluster.

Yes — once you add an image from ECR, Artifact Registry, or ACR, it's automatically rescanned every 24 hours for as long as it stays on your monitored list, so newly-disclosed CVEs get caught without you doing anything. This is a paid-plan feature, not available on trial; each plan caps how many images can be monitored at once.

For dependency/CVE findings, Prasovi checks whether the vulnerable package is actually imported in your scanned code, marking each finding Reachable, Unreachable, or Unknown. This is a package-level check (not function-level) and Python-only for now — Unknown is the honest result whenever reachability can't be determined, rather than a guess in either direction.

Yes — mint a scoped API token per repository from Settings, then trigger a scan from GitHub Actions, GitLab CI, Azure Pipelines, or Bitbucket Pipelines to get a pass/fail result, without sharing your own login. You can set which severity fails the build (e.g. High and above), and separately choose to always fail on any cloud-credential-leak correlation regardless of severity.