Docs
Powered by

Build Your Security Platform

Create a complete application security solution rivaling Aikido, Snyk, or Veracode — with full control over detection, AI analysis, and remediation.

Architecture

'actorTextColor': '#1e293b', 'actorBkg': '#f1f5f9', 'signalColor': '#6366f1', 'signalTextColor': '#1e293b', 'noteBkgColor': '#fef3c7' }}}%% sequenceDiagram participant GH as GitHub participant WF as Workflow participant AI as Security Agent participant DB as Database

GH->>WF: Webhook (push/PR)
WF->>GH: Fetch files
loop Each file
    WF->>AI: Analyze
    AI-->>WF: Findings
end
WF->>DB: Store
WF->>GH: Block or Approve

### Workflow Steps

||| Step 1: Parse Event (VARIABLE)
```json
{
  "schemaVersion": "1.0",
  "stepId": "parse-event",
  "name": "Parse GitHub Event",
  "type": "VARIABLE",
  "next": "fetch-files",
  "def": {
    "type": "VARIABLE",
    "vars": {
      "repo": {"expr": "{{input.repository.full_name}}", "type": "STRING"},
      "owner": {"expr": "{{input.repository.owner.login}}", "type": "STRING"},
      "ref": {"expr": "{{input.after}}", "type": "STRING"}
    }
  }
}

|||

Step 2: Fetch Files (CONNECTOR) 
{
  "schemaVersion": "1.0",
  "stepId": "fetch-files",
  "name": "Fetch Changed Files",
  "type": "CONNECTOR",
  "next": "filter-files",
  "def": {
    "connectorName": "GitHub",
    "operation": {
      "name": "Get Commit Files",
      "operationType": "HTTP",
      "connection": {"type": "BINDING", "bindingName": "github-integration"},
      "operationInput": {
        "type": "HTTP",
        "baseUrl": "https://api.github.com",
        "path": {"owner": "{{variables.owner}}", "repo": "{{variables.repo}}", "sha": "{{variables.ref}}"}
      }
    }
  }
}
Step 3: Filter Files (FUNCTION) 
{
  "schemaVersion": "1.0",
  "stepId": "filter-files",
  "name": "Filter Code Files",
  "type": "FUNCTION",
  "next": "analyze-loop",
  "def": {
    "language": "PYTHON",
    "content": "def execute(context):\n    files = context.steps.get('fetch-files', {}).get('response', {}).get('files', [])\n    exts = ['.js', '.ts', '.py', '.java', '.go', '.rb', '.php']\n    return {'files': [f for f in files if any(f['filename'].endswith(e) for e in exts)]}"
  }
}
Step 4: Analyze Loop (LOOP + AIAGENT) 
{
  "schemaVersion": "1.0",
  "stepId": "analyze-loop",
  "name": "Analyze Files",
  "type": "LOOP",
  "next": "aggregate",
  "def": {
    "loopType": "OVERDATA",
    "props": {"dataRef": "{{step.filter-files.files}}"},
    "beginStepId": "fetch-content"
  }
}

Nested: AI Analysis

{
  "schemaVersion": "1.0",
  "stepId": "ai-analyze",
  "name": "AI Security Analysis",
  "type": "AIAGENT",
  "parent": "analyze-loop",
  "def": {
    "agentId": "security-analyst",
    "agentName": "Security Analyst",
    "input": "Analyze {{loop.current.item.filename}} for vulnerabilities:\n\n{{step.fetch-content.response.content | b64decode}}"
  }
}
Step 5: Check & Act (CONDITION) 
{
  "schemaVersion": "1.0",
  "stepId": "check-critical",
  "name": "Check Critical Findings",
  "type": "CONDITION",
  "def": {
    "expressions": [
      {"label": "Critical", "exp": "{{step.aggregate.critical_count}}", "op": "GREATER_THAN", "value": "0", "next": "block-pr"},
      {"label": "Clear", "exp": "true", "op": "EQUALS", "value": "true", "next": "approve"}
    ]
  }
}

Step 3: Dependency Scanning

Software Composition Analysis (SCA) detects vulnerable packages.

Supported Ecosystems

Ecosystem Manifests
npm package.json, yarn.lock
Python requirements.txt, pyproject.toml
Java pom.xml, build.gradle
Go go.mod, go.sum
Ruby Gemfile, Gemfile.lock

Query OSV Database

{
  "schemaVersion": "1.0",
  "stepId": "query-osv",
  "name": "Query OSV Database",
  "type": "CONNECTOR",
  "def": {
    "connectorName": "HTTP",
    "operation": {
      "operationType": "HTTP",
      "operationInput": {
        "type": "HTTP",
        "baseUrl": "https://api.osv.dev",
        "method": "POST",
        "path": {},
        "body": {"queries": "{{step.parse-deps.dependencies}}"}
      }
    }
  }
}

Step 4: Secrets Detection

Detect leaked credentials before they reach production.

Common Patterns

Type Pattern
AWS Key AKIA[0-9A-Z]{16}
GitHub Token ghp_[a-zA-Z0-9]{36}
Slack Token xox[baprs]-[0-9a-zA-Z-]+
Private Key -----BEGIN.*PRIVATE KEY-----
Generic API Key api[_-]?key.*[:=].*[a-zA-Z0-9]{20,}

AI Detection Step

{
  "schemaVersion": "1.0",
  "stepId": "detect-secrets",
  "name": "Detect Secrets",
  "type": "AIAGENT",
  "def": {
    "agentId": "security-analyst",
    "input": "Scan for exposed secrets (API keys, passwords, tokens, private keys):\n\n{{step.fetch-content.response.content | b64decode}}\n\nIgnore test mocks, env var refs, and placeholders. Return confirmed secrets only."
  }
}

Step 5: IaC Scanning

Validate Terraform, Kubernetes, and CloudFormation configs.

Check for Misconfigurations

  • Public exposure (0.0.0.0/0)
  • Missing encryption
  • Overly permissive IAM
  • Missing logging
  • Hardcoded secrets
  • Insecure protocols
{
  "schemaVersion": "1.0",
  "stepId": "analyze-iac",
  "name": "Analyze IaC",
  "type": "AIAGENT",
  "def": {
    "agentId": "security-analyst",
    "input": "Analyze this infrastructure config for security misconfigurations:\n\n{{step.fetch-content.response.content | b64decode}}\n\nCheck: public exposure, encryption, IAM, logging, secrets, protocols."
  }
}

Step 6: Auto-Fix PRs

Automatically generate remediation pull requests.

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#22c55e'}}}%%
flowchart LR
    F["Finding"] --> G["Generate Fix"]
    G --> B["Create Branch"]
    B --> C["Commit"]
    C --> P["Create PR"]
    
    style F fill:#fee2e2,stroke:#ef4444
    style P fill:#dcfce7,stroke:#22c55e

Create Security Fix PR

{
  "schemaVersion": "1.0",
  "stepId": "create-pr",
  "name": "Create Security Fix PR",
  "type": "CONNECTOR",
  "def": {
    "connectorName": "GitHub",
    "operation": {
      "name": "Create Pull Request",
      "operationType": "HTTP",
      "connection": {"type": "BINDING", "bindingName": "github-integration"},
      "operationInput": {
        "type": "HTTP",
        "body": {
          "title": "🔒 Fix: {{loop.current.item.title}}",
          "body": "## Security Fix\n\n**Severity:** {{loop.current.item.severity}}\n**CWE:** {{loop.current.item.cwe}}\n\n{{loop.current.item.description}}\n\n---\n*Auto-generated by work.studio*",
          "head": "security/fix-{{loop.current.item.id}}",
          "base": "main"
        }
      }
    }
  }
}

Step 7: Alerting

Intelligent notifications with deduplication.

Deduplicate Findings

{
  "schemaVersion": "1.0",
  "stepId": "dedupe",
  "name": "Deduplicate Findings",
  "type": "AIAGENT",
  "def": {
    "agentId": "security-analyst",
    "input": "Group {{step.aggregate.total_count}} findings:\n\n1. Same vuln in different files = 1 grouped finding\n2. Same CVE across packages = 1 finding\n3. Similar patterns = 1 finding with all locations\n\nFindings:\n{{step.aggregate.findings | tojson}}"
  }
}

Slack Notification

{
  "schemaVersion": "1.0",
  "stepId": "notify",
  "name": "Notify Security Team",
  "type": "CONNECTOR",
  "def": {
    "connectorName": "Slack",
    "operation": {
      "name": "Send Message",
      "operationType": "HTTP",
      "connection": {"type": "BINDING", "bindingName": "slack-security"},
      "operationInput": {
        "type": "HTTP",
        "body": {
          "channel": "#security-alerts",
          "blocks": [
            {"type": "header", "text": {"type": "plain_text", "text": "🚨 Security Alert"}},
            {"type": "section", "text": {"type": "mrkdwn", "text": "*Repo:* {{variables.repo}}\n*Critical:* {{step.aggregate.critical_count}}"}}
          ]
        }
      }
    }
  }
}

Quick Reference

Expression Patterns

Pattern Example
{{input.x}} {{input.repository.name}}
{{step.id.x}} {{step.fetch.response.data}}
{{variables.x}} {{variables.owner}}
{{loop.current.item}} {{loop.current.item.file}}
{{connections.x}} {{connections.github}}

Filters

Filter Usage
tojson {{data \| tojson}}
b64decode {{content \| b64decode}}
length {{items \| length}}

Comparison

Feature Aikido Snyk work.studio
SAST ✓ ✓ ✓
SCA ✓ ✓ ✓
Secrets ✓ ✓ ✓
IaC ✓ ✓ ✓
Auto-Fix ✓ ✓ ✓
Custom AI ✗ ✗ ✓
Custom Rules Limited Limited Unlimited
Self-Hosted ✗ ✗ ✓

Next Steps