A high-throughput control plane for engineering teams. Ingests GitHub push webhooks in under 35ms, scans diffs with Shannon entropy and 40+ credential signatures, and reconciles incident lifecycles automatically.
Developers frequently bypass client-side pre-commit hooks using git commit --no-verify. Without an un-bypassable cloud supervisor, leaked secrets sit in Git histories for months until attackers exploit them.
Large release pushes contain hundreds of file diffs. Synchronous scanners exceed GitHub's 10-second delivery window, dropping events and blinding security teams.
Naive security tools store detected credentials in plaintext database columns, turning the scanner into a high-value attack target during SQL injections or backup dumps.
At-least-once webhook retries and parallel CI runs create duplicate tickets for identical commit SHAs, flooding SecOps channels with ghost findings.
Incoming payloads to /api/v1/webhooks/github are validated using constant-time HMAC-SHA256 comparison and immediately enqueued onto Redis. The HTTP handshake completes in <35ms, satisfying GitHub SLAs with zero dropped events.
Dual-Cipher Architecture: secret signatures are salted and blind-indexed via HMAC-SHA256 for instantaneous deduplication queries (WHERE secret_hash = :hash). Raw tokens are never stored in plaintext.
When a subsequent commit eliminates the offending token line, the Celery worker automatically updates the ticket status to RESOLVED (REMOVED_IN_COMMIT). If the key resurfaces on another branch, it triggers an instant regression escalation.
Every detected finding receives a deterministic fingerprint computed from SHA256(RepoID + RuleID + FilePath + BlindHash) with a PostgreSQL UNIQUE constraint, eliminating ghost findings during webhook retries.
The aegis CLI runs locally with zero runtime dependencies. Install pre-commit hooks or integrate scans directly into GitHub Actions, GitLab CI, and Docker builds.
Inspects uncommitted diffs and full repo history against 40+ credential rule definitions.
Sets up executable pre-commit intercept hooks in the active Git repository.
Authenticates the CLI sensor with your central control plane organization.
Aegis detects AWS Access Keys (AKIA*), GitHub Personal Access Tokens (ghp_*), Stripe Live Keys (sk_live_*), Private RSA/EC keys, Database Connection Strings, Slack Webhooks, JWT signing keys, and high-entropy API tokens across 40+ detection signatures.
No. Aegis enforces a strict zero-plaintext storage policy. Detected secret signatures are transformed into an HMAC-SHA256 blind index using an environment pepper. The web console and Slack notifications render only masked snippets (e.g. sk_live_****3a9f).
Yes. Aegis is 100% open-source and provides pre-configured Docker Compose, Render Blueprint (render.yaml), and standard PostgreSQL + Redis orchestration manifests.
The FastAPI ingestion gateway validates the incoming payload's HMAC-SHA256 signature and enqueues the job onto Redis with an immediate HTTP 202 response within 35ms, comfortably satisfying GitHub's 10-second delivery SLA.
Connect your GitHub repositories in less than two minutes. Open-source, zero-trust, and engineered for high-throughput development pipelines.