Plate I·Pitangus sulphuratus
Self-hosted application security for small teams. Pitangus scans your code, dependencies and secrets, tells you what each change introduces and what it fixes, and keeps the evidence an auditor can check.
Field guide
Seven open engines you already trust look at your code, dependencies, secrets, infrastructure and images. Pitangus merges what they find, removes duplicates and files each finding with where it lives and how to fix it.
Opengrep · Gitleaks · Trivy · OSV-Scanner · Grype · Checkov · zizmor
CWE-89
app/db.py:14
Request input reaches a query built as text.
CVE-2021-23337
package-lock.json
Update to 4.18.0: it closes all six advisories.
CWE-798
config/settings.py:3
Revoke it first. Its value never leaves your server.
CKV_AWS_20
infra/s3.tf:8
Anyone could list it. Block public access.
Pull requests
In CI, Pitangus scans the starting point and your change with the same engines, so a pull request is judged only by what it adds. It also says what the change fixed, and credits it only when both scans finished and the file really changed.
One step in your workflow
- uses: actions/checkout@v4
with: { fetch-depth: 0 }
- uses: Pitangus-Dev/pitangus@v0.12.0The official GitHub Action runs the published image: no build, no Docker socket.
$ pitangus scan --base main
Pitangus · api · changes since main (merge-base 4f2a9c1e, 1 file) No new findings. Fixed by this change (1): it was in the starting point, it’s gone, and its file changed. HIGH app/db.py:14 SQL injection from request input PASS · threshold: high or above · No new findings in the code that changesThe ledger
Each finding keeps its history: when it appeared, who triaged it and why, its deadline from your policy, and the scan that proved it gone. Decisions are recorded, not overwritten.
| Finding | Status | Deadline |
|---|---|---|
| SQL injection · app/db.py:14 | Fixed | Oct 20 |
| lodash 4.17.15 · 6 vulnerabilities | Open | Oct 30 |
| Public bucket · infra/s3.tf | Accepted risk | Until Dec 1 |
The same code, engines and advisory data give the same result. An auditor can repeat it.
SBOM (CycloneDX), VEX (OpenVEX), SLA reports and an audit trail of every decision.
If an engine fails, the scan says so, and nothing that engine looks at counts as fixed. It never reads as “no findings”.
Any tool, one ledger
Import SARIF from any scanner or AI reviewer. Its findings join the same registry, with triage, deadlines and tickets. Only a new full import from that same tool can mark them fixed: each tool vouches for what it looks at.
Jira
Issues go to the right project for each repository, with your custom fields. They say what is wrong, where, how to fix it, how to verify it and by when. When the fix is verified, Pitangus comments on the issue.
SEC-142
Verified as fixed by Pitangus in scan 9f3c… on Oct 2.
Yours
One server with Docker and 4 GB of memory. Your code and findings stay with you.
AGPL-3.0. Read every line, change it, run it without asking.
Written for each language, not machine-translated. Reports, PR comments and tickets included.
Nothing phones home. It only reaches out for public advisory data and, if you connect them, GitHub and Jira.
Install
1You need Docker, make and git.
2Start it and open the panel.
git clone --branch v0.12.0 https://github.com/Pitangus-Dev/pitangus.git
cd pitangus
make setup PREBUILT=1
make up3Or add the Action to your workflow.
- uses: Pitangus-Dev/pitangus@v0.12.0Read the docs Free and open source (AGPL-3.0). It runs on your server: no account, no telemetry.