Documentation

// Kestrel security scanning for your repositories

Getting started

Kestrel runs security scans on your Git repositories using industry-standard tools. Sign in with GitHub, select a repo from the dashboard, run a scan, and review findings by severity.

  1. Sign in with your GitHub account
  2. Select a repository from your dashboard
  3. Start a scan — results appear in Scan history and on the result page
  4. Fix or dismiss findings and re-scan as needed

Try the demo result to see a sample report.

Scan tools

Gitleaks

Finds secrets and credentials in your repo history: API keys, passwords, tokens, and other sensitive data that shouldn't be committed.

Trivy

Scans dependencies and container images for known vulnerabilities (CVEs) and misconfigurations.

Understanding results

Findings are grouped by severity: Critical · High · Medium · Low. Each finding includes location, rule ID, and a short description. Use the result page to filter by tool or severity and toggle the AI summary for a quick analysis.

Need help? Contact support or open an issue in the Kestrel repo.