Fitting in
Pipelines and SARIF
Fail a build on what you choose, or hand findings to whatever already reads SARIF.
Exit codes that mean something
The scanner exits non zero on your choice of: any secret, only verified secrets, any critical, any high, or a license policy failure. That is the whole integration for most pipelines.
SARIF out
The standard format a Security tab, a code host and most vulnerability managers already read. Uploading it uses the pipeline's own token, which is how pull request annotations happen without this tool ever needing write access.
Only what changed
A review can be limited to the files changed against a reference, so a pipeline reports what somebody wrote rather than the repository's whole backlog.
What it does not do
It is a command and a schema rather than a polished integration. Snyk and Semgrep both ship curated CI policies and pull request comments out of the box; this is more assembly.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.