Your clients demand proof about your code. Not a spreadsheet.
Scanners detect the flaws. CodeCleared codifies your dependency decisions — allowed, tolerated, blocked, documented — and turns them into exportable proof for your security questionnaires, due diligences and audits.
→ Connect a GitHub repo: scan dependencies, secrets and licenses → policies enforced in CI → non-compliant PRs blocked → proof exported (CSV / SBOM).
No credit card · GitHub-first · diagnostic on one repo in minutes
- Scan complete — repo/api-gateway2m
- PR blocked — license violation14m
- License check — clean2h
What protects you from the first scan
Your scanners find the flaws. No one can prove what you did about them.
The 200-line security questionnaire
Every enterprise deal reopens the same spreadsheet. You retype by hand answers you already gave three months ago.
Lost dependency decisions
"We allow lodash but not moment" lives in a 2023 Slack thread. No rule, no trace, no capitalization.
The audit that's coming
DORA, NIS2, M&A due diligence: they require timestamped proof. A PowerPoint export won't cut it.
CodeCleared turns your decisions into enforced rules and exportable proof. Once. For good.
Your first policies in 3 steps
Less than 5 minutes from repo clone to your first compliance score.
Connect your source code
OAuth GitHub, read-only. GitLab / Bitbucket coming. European hosting.
Personalize your first policies
Start from a light template, adjust rules per category (Auth, Database, UI Framework…). Centralized in CodeCleared, enforced across your repos.
Walk away with your proof
First automatic scan. Compliance score 0-100. Policies enforced. Exportable proof (CSV / SBOM) ready for your next client questionnaire.
No K8s setup. No onboarding consulting. No credit card.
What you get from the first scan
No blank slate. The platform comes with a solid base to customize.
The governance flow, in 3 movements
Aikido detects. Snyk scans. CodeCleared codifies.
Build your policy library
Codify YOUR security expertise into custom rules by dependency category. You build the library once — it applies to all your projects. It's your IP, not ours.
- 12+ business categories ready to customize (Auth, Database, HTTP Client, UI Framework, Validation, Queue & Job, Build Tools, Caching…)
- Custom rules by category: allow / forbid / warning
- Configurable quality gates: minimum maintainers, update frequency, license compliance
- 1,700+ stock SAST rules + Custom tab for your own rules
- 120+ pre-evaluated open-source licenses (67 whitelist + 55 blacklist)
- Package Finder: search and evaluate a package BEFORE installation
- Starter templates to customize (not rigid presets)
Apply your decisions at scale
The policy-as-code engine by dependency category. Not just a feature among others — the foundation of your technical governance.
- Policies per category with allow / forbid / warning
- Blocking PR checks native to GitHub (GitLab / Bitbucket coming)
- 9 supported ecosystems: npm, yarn, pnpm, pip, gem, maven, gradle, cargo, composer
- Service Tokens (API keys) for CI/CD automation
- Parent → child organizations (multi-project, billing)
- Override tracking with author, reason and expiration
- Quality Gates: minimum maintainers, update frequency, license compliance
- License Policy: whitelist / blacklist by usage
- override approuvé — bcrypt 4.x · j.dupont2h
- policy mise à jour — crypto: forbid1j
- scan complet — 12 projets1j
Prove your compliance on demand
All the artifacts you need to defend your governance to an auditor, a regulator, or a demanding B2B client.
- Compliance score 0-100, computed and defensible
- On-demand reports (PDF & CSV export) covering governance, quality, licenses, vulnerabilities, secrets
- CycloneDX SBOM (cryptographic signature 🚧 roadmap Q3 2026)
- Timestamped & exportable audit trail
- Public Notice Disclosures (Apache 2.0 NOTICE file replacement, shareable signed URL)
- Comprehensive DORA / NIS2 / HDS / ISO 27001 reports (signed ZIP Export Pack 🚧 roadmap Q3 2026)
Customizable SLAs by criticality
Your policies define what's allowed. Your SLAs define when you fix it. Together, they prove operational mastery.
Exploitable vulnerabilities, exposed secrets, immediate blocking
CVSS 7+ vulnerabilities, to fix within the week
Medium CVEs, dependencies to update
Hygiene, security tech debt
The detection ↔ compliance bridge
DORA Art. 11, NIS2 Art. 21, HDS R28, ISO 27001 A.16, SOC 2 CC7 all require documented SLAs. No vendor centers it as a value prop. Open territory.
SLAs by criticality, configurable
Defined per policy, per category, per client project. Versioned in Git like the rest of your governance.
Compliance score connected to SLA
Your score doesn't just measure "are findings present". It measures "did you resolve them within your committed deadlines".
Automatic escalation by tiers
50% SLA elapsed → Slack alert. 80% → manager escalation. Exceeded → audit trail with mandatory justification.
SIEM-compatible SLA audit trail
Every vuln × deadline × resolution cryptographically timestamped. Exportable to regulator. Defensible.
Virtual 0 SLA
Aikido detects. Snyk scans. CodeCleared codifies AND maintains at zero.
Virtual 0 SLA is the ideal state where no vulnerability exceeds its contracted SLA. It's an asymptotic goal: there will always be new vulnerabilities, but they must be handled within their window.
Virtual 0 Maintenance Score (90d)
You maintained Virtual 0 for 70 of the last 90 days. Above-average for fintech.
The metric you check daily
Dashboard opened every morning. Burn-down flashes red, team knows what to do.
The score you defend during audit
90-day Maintenance Score auditable = direct evidence for DORA Art. 11, NIS2 Art. 21, HDS R28.
The KPI you track per client (Team use case)
Team plans scale governance across client repos with per-project compliance scores and exportable proof.
The product. Not just the pitch.
Two views you use today, plus a glimpse of the roadmap.
Live compliance score
0-100 score per project and organization. 90-day trend. Top non-compliances.
{
"apiVersion": "codecleared.io/policy/1.0.0",
"kind": "PolicyBundle",
"metadata": { "name": "saas-b2b", "version": "1.0.0" },
"spec": {
"categoryDirectives": [
{ "metadata": { "ref": "crypto" },
"spec": { "categorySlug": "cryptography", "mode": "blacklist", "defaultBehavior": "forbid" } }
],
"licensePolicies": [
{ "metadata": { "ref": "allowed-licenses" },
"spec": { "mode": "whitelist", "licenses": ["MIT", "Apache-2.0", "BSD-3-Clause"] } }
]
}
}Your rules, centralized and exportable
Defined once, enforced in CI/CD across your repos. Exportable as JSON/CSV bundles.
Audit-ready in 1 click
ZIP: reports + SBOM + audit trail + policies, DORA / NIS2 format. Cryptographic signature and Export Pack in progress — roadmap Q3 2026.
- reports/on-demand/*.pdf12 fichiers
- sbom/cyclonedx-signed.json8 projets
- audit-trail/*.jsonl2 437 events
- policies/snapshot.json47 règles
Built for B2B SaaS CTOs
Above your scanners — the governance and proof layer.
B2B SaaS teams
Your clients demand proof (security questionnaire, due diligence). Codify your dependency decisions, enforce them in CI, export the proof. Your policies as versionable JSON bundles.
See it for engineering →- Centralized policies enforced across your GitHub repos
- Blocking GitHub PR checks
- Override tracking with audit trail
- Live compliance score on every PR
- CSV / SBOM evidence export
We spent 5 years tabling in Excel for audits we watched fail.
While Snyk and Aikido stack detection features, the industry suffers from the same problem: too many alerts, not enough decisions. And no one can prove what they did when a DORA auditor shows up.
CodeCleared is the tool we wish we'd had as fintech CTO under audit. Codify our decisions once. Apply them mechanically. Prove them cryptographically.
We're small, we're French, we're focused. Not a 4-pillar platform that dilutes. Just governance, done seriously.
Three approaches, three categories
Aikido and Snyk are excellent in their domains. CodeCleared is inventing its own.
| Capability | CodeCleared | Aikido | Snyk |
|---|---|---|---|
| Categorical Policies per dependency | |||
| Custom policy authoring by business category | |||
| Auditable compliance score | |||
| 90-day Maintenance Score auditable | |||
| Pricing by governance depth | |||
| Customizable SLAs by criticality | |||
| Daily Virtual 0 SLA dashboard | |||
| Certified EU sovereign hosting | |||
| Cryptographically signed reports |
Honest box. Aikido excels at finding triage, AutoFix, noise reduction. Snyk excels at large-scale vulnerability data. CodeCleared focuses on decision governance. 🚧 = announced, not yet shipped (we never check a feature we haven't delivered).
Frequently asked questions
Honest answers to the 10 classic objections.
Exclusively in the European Union, hosted in France (OVH). No data ever leaves the EU. The source code you scan is never persisted on CodeCleared side (temporary clone in isolated environment, deleted within 1-5 minutes after scan).
Under 5 minutes. Connect GitHub (30s) → pick a starter template (1 click) → first scan (60s) → compliance report delivered. No onboarding consulting required to get started. Custom Policy Authoring sessions (help writing your rules) are available on advanced plans.
For a solo dev wanting basic scanning, OWASP Dependency-Check does the job. For a team wanting to industrialize, capitalize decisions, produce auditable artifacts, integrate in CI/CD and prove compliance to regulators — it's not the right tool. CodeCleared brings the layers ABOVE the scan: governance, traceability, multi-tenant, signed SBOM.
Aikido excels at finding triage and AutoFix. Snyk excels at vulnerability database at scale. We excel at governance codification. Three different categories. See the comparison table above for the bullshit-free feature × feature breakdown.
Aikido cannot pivot to governance without rewriting their data model (their atomic unit is the Finding, ours is the Policy). That's 12-18 months of product refactor + revenue cannibalization. Possible but unlikely. And even if they try, our EU sovereign architecture remains a non-replicable wedge from SF.
Your policies are exportable in standard formats (CSV/JSON) at any time. You keep your IP. Open format, no vendor lock-in. Your exports are in open formats (CSV, CycloneDX SBOM). You can leave us while keeping your assets.
We're early stage: first B2B SaaS design partners underway via the Pioneer Program. If you want Aikido's 50 logos, we're not for you today. If you want to co-build a nascent category with direct founder support, let's talk.
Simpler than expected. Your repos are already on GitHub — we read the same. Your current policies (often scattered in wikis and scripts) become the first rules to formalize in CodeCleared. We support you with Custom Policy Authoring sessions on advanced plans.
Yes, on Team and Regulated plans: Virtual 0 SLA dashboard (`/sla`), configurable severity rules, 90-day maintenance score, and `finding.sla.*` webhooks. Alerts go through your outbound webhooks (Slack or JSON format) — there is no dedicated native Slack connector.
Pricing is public and transparent (no enterprise-only-call-us). Simple model: a plan base with N active licenses per month + usage-based credits — you pay for licenses in your pool and for what you scan. Unused licenses are lost at month end. Details on /pricing. No surprises on the invoice.
Service Tokens (API keys) scoped per organization with configurable expiration. REST v1 endpoints: trigger a scan and fetch scores, vulnerabilities, licenses, secrets and SBOM per project-unit. HMAC-signed outgoing webhooks for scan-completed, compliance-score-changed, policy-violated and pr-check-failed events — native Slack format or generic JSON to any service, with retries.
Yes — the Public Notice Disclosures feature automatically generates your NOTICE files (Apache 2.0 replacement) from licenses detected in your dependencies. Signed URL shareable with your partners, customers or regulators. Useful for OSS distribution, license compliance in SaaS, M&A due diligence.
The next security questionnaire is coming. Be ready.
Connect a GitHub repo. Walk away with your policies, PR checks and first exportable proof — in minutes.
No credit card · GitHub-first · diagnostic on one repo