La plateforme
The governance platform
Everything CodeCleared does to codify, enforce and prove your supply chain governance.
Software Composition Analysis (SCA)
Dependency scanning as the execution engine for policies — not as a finished product.
- Universal support: npm, yarn, pnpm, pip, gem, maven, gradle, cargo, composer (9 ecosystems)
- Automatic detection of all lockfiles in monorepos
- Unified scan: SBOM + vulnerabilities + secrets + licenses in a single orchestrated scan
- Precise Root vs Transitive distinction
- Automatic dependency categorization by business function
scan — repo/api-gateway
react@18.2.0clean
lodash@4.17.20CVE
left-pad@1.3.0AGPL
express@4.18.2clean
142 dépendances3 signalées
Dependency Advisor — The governance engine
The core product: turn your security decisions into living rules.
- Business categorization of dependencies (Auth, Database, HTTP Client, UI Framework, Validation…)
- Policies per category with allow / forbid / warning
- Reusable rules library you build yourself
- Parent → child organizations (multi-tenant, billing)
- Quality Gates: minimum maintainers, update frequency, license compliance
- Override tracking with author, reason and expiration
Dependency Advisororg-level
Authwarning
Cryptoforbid
HTTP Clientallow
Databaseallow
12 catégories · appliquées sur 12 projets
License compliance
Compliance you control, export, defend during audits.
- Automatic detection of all open-source licenses
- Per-organization customizable license policies
- Alerts on license incompatibilities (GPL, AGPL, LGPL…)
- 100% hosting in the European Union
- On-premise & certified sovereign hosting 🚧 roadmap
- DORA / NIS2 / HDS / ISO 27001 mapping assistance (supported, not certified)
Conformité licences🇪🇺 UE
Score conformité94%
MIT87OK
Apache-2.024OK
AGPL-3.02bloqué
Secrets Detection
Automatic detection of exposed secrets, integrated into the governance flow.
- All secret types: API keys, tokens, passwords, certificates
- Automatic scan on push and Pull Requests
- Configurable PR blocking on critical secret detection
- Policy per secret type with business rules
- Real-time alerts with routing by category
secrets scan — push
config/prod.env:14PR bloquée
AWS_SECRET_KEY = AKIA••••••••4F2A
Clé Stripe détectée — routée à #security
Automatic PR Checks
Policy enforcement directly in your development flow.
- 5 checks: Vulnerabilities, Secrets, Licenses, Dependency Advisor, SAST
- Native GitHub integration (GitLab + Bitbucket on the roadmap)
- Flexible configuration: org defaults + repo overrides + PR exceptions
- Override audit trail with documented reason
- Live compliance score on every PR
my-repo / #1247Open
VulnerabilitiesPASSED
SecretsPASSED
LicenseBLOCKED
Dependency AdvisorPASSED
SASTPASSED
Merge bloqué — policy de licence