OneSec
Read the code. Fix the finding. Prove the control.
The AI GRC engineer for your codebase. OneSec scans every repository, patches what it finds and turns the result into audit evidence for 56 frameworks, on your own infrastructure.
- security and compliance checks
- 238
- compliance frameworks mapped
- 56
- languages, and 5 infrastructure platforms
- 10
- your code stays on your infrastructure
- Self-hosted
One scan covers the whole codebase
238 checks cover your application code, dependencies, secrets, infrastructure, APIs, mobile apps and running sites. Every pull request is scanned against its base branch, so new risk shows up before it merges.
-
Follow a vulnerable package to the line that pulls it in
Lockfiles from 12 ecosystems are read into components and checked against OSV.dev. Transitive paths show which of your dependencies brought the problem.
-
140
application security checks
Source code in 10 languages, API contracts and mobile apps, with optional Semgrep CE rules for deeper analysis.
-
5
infrastructure platforms
Terraform, CloudFormation, Kubernetes, Docker and GitHub Actions: public storage, missing encryption, wildcard IAM, privileged containers.
-
Secrets, caught as they are written
Finds hardcoded secrets and committed key files, and flags a secret the moment an AI agent writes one.
-
Read-only testing of running apps
GET, HEAD and OPTIONS requests only, against hosts with a recorded authorization. No payloads, no fuzzing.
-
APIs and mobile apps
OpenAPI, Swagger and GraphQL definitions, Android manifests, iOS Info.plist files and built .apk and .ipa packages.
-
Continuous scanning
Watches local folders and polls GitHub, rescanning only what changed. Results appear as GitHub Checks annotations.
-
Results from tools you already own
Import SARIF from CodeQL, Semgrep, Gitleaks, Trivy, Checkov and others, with the source recorded on every finding.
-
Bills of materials and reports
An SBOM in CycloneDX 1.5 with a VEX export, and every scan as a report for people or machines.
From finding to verified fix
A finding is only useful when it gets closed. OneSec writes the patch, sends the work to the tool your team already uses, and retests until the fix is verified.
-
8
ticket destinations
GitHub Issues, GitHub Enterprise, Jira Cloud and Data Center, Linear, ServiceNow and Slack. Send one finding or a hundred at once.
-
A gate in every pipeline
Ready-made templates fail the build at the severity you choose, and findings show up in each system’s own security view.
-
Fix what attackers use first
The remediation queue ranks work by FIRST EPSS exploit probability and the CISA Known Exploited Vulnerabilities list.
-
Retests, not promises
A finding is marked verified fixed only when the retest says so. Otherwise it stays open as still present or inconclusive.
-
Tickets that close themselves
A ticket closes automatically, and only with verified-fix evidence attached.
-
Patches you can review
Each fix is a plain unified diff, generated the same way every time, so a reviewer sees exactly what changes.
-
Triage that sticks
Confirm a finding or mark it a false positive with a reason and an expiry date. The decision and its history travel into CI.
Evidence your auditor can open
Compliance work is evidence work, and most of the evidence is already in your code. OneSec maps what it finds to the controls you answer for, and one control counts everywhere it applies.
OneSec produces readiness evidence. It does not issue certifications.
-
An audit package, ready to hand over
Ten numbered files with evidence snapshots and a manifest for the period your auditor asks about. Every export carries a SHA-256 checksum, so the reader can check nothing changed.
-
56
compliance frameworks
SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, the EU AI Act and more, plus your own as a JSON file.
-
2,276
requirements mapped
Each one tied to the common control that satisfies it, so evidence is collected once.
-
70
common controls
One passing control counts toward every framework it applies to.
-
352
document deliverables
Policies, statements of applicability and reports, written from your evidence.
-
Security questionnaires
Answer customer questionnaires from evidence you already have instead of from memory.
-
Trust center page
Publish a page for customers built only from verified facts: the control groups you pass and the subprocessors detected in your code.
-
Risks, exceptions and attestations
A 5×5 risk register, 17 policies with drift tracking, and exceptions and attestations that expire on the date you set.
-
A record that cannot be quietly edited
Every action in the console lands in an activity log where each entry is chained to the last with a SHA-256 hash.
Govern the AI you ship and the agents that write your code
OneSec keeps a register of the AI in your product and finds the AI nobody declared. It also works inside your coding agent, so problems are caught while the code is being written.
-
25
AI governance checks
They build a register of the models and AI services in your code, and flag the ones nobody declared.
-
Find the AI nobody declared
OneSec reads your code for model and AI service calls and compares them with the register. Anything missing is a finding, mapped to the EU AI Act and the OWASP Top 10 for LLM applications.
-
31
MCP tools
Your agent scans, explains, remediates and files tickets without leaving the session. 16 skills come with the plugin.
-
A guard on every edit
A hook checks each file the agent writes and stops a secret before it reaches a commit.
-
Feedback with a limit
New findings go back to the agent that wrote the code, capped at three fix requests per session so it never loops.
-
EU AI Act and bias audits
Records your role under the EU AI Act and runs bias audits with the four-fifths rule, including the format New York City Local Law 144 asks for.
-
AI bill of materials
Exports an AIBOM in CycloneDX 1.6.
-
Works with the agent you use
A plugin for Claude Code and Codex, with feedback hooks for four coding agents.
Runs where your code lives
OneSec is self-hosted. Your source code and findings stay on infrastructure you control, and the scanner works offline unless you turn a lookup on.
$ docker compose up -d Container onesec-console Started OneSec listening on http://127.0.0.1:8080
- One containerDocker Compose starts the console and the scan engine together.
- Private by defaultThe console listens on the local machine only until you choose to expose it.
- Offline by defaultVulnerability and licence lookups are opt-in. Managed scanners can run in Docker with no network access.
- Nothing to install around itThe scan engine has zero runtime dependencies and stores console data in a local SQLite file.
- Book a demoLog in to the console
Straight answers
The questions security and engineering leads ask first.
Does my source code leave my network?
No. OneSec runs on your own machines and scans offline by default. Vulnerability lookups on OSV.dev and licence enrichment are opt-in.
Does OneSec certify us for SOC 2 or ISO 27001?
No. OneSec produces readiness evidence and the audit package. An accredited auditor still issues the certification.
How do you keep false positives down?
Three ways. Every finding can be confirmed or marked a false positive with a reason and an expiry, and that decision travels into CI. Patches are generated the same way every time, so a reviewer can trust the diff. And a fix only counts once a retest verifies it. Checks are pattern-based leads, so a person still makes the call.
Which languages and platforms are covered?
JavaScript, TypeScript, Python, Go, Java, Kotlin, Scala, C#, Ruby and PHP, plus Terraform, CloudFormation, Kubernetes, Docker and GitHub Actions. Semgrep CE rules cover JavaScript, TypeScript and Python.
Can we add our own framework?
Yes. Alongside the 56 built-in frameworks you can load a custom framework as a JSON file and map it to the same controls.
Is the console multi-user?
Yes. Named users sign in with a local password, Google, Microsoft Entra ID or LDAP, and each has an Administrator, Member or Viewer role. Ticketing has its own scoped Viewer, Sender and Manager API keys.
See it on your own repository
Bring one repository to a demo. It is scanned on your machine, and you leave with its findings, the first patches and its readiness against the framework you care about.
- Your code stays on your machine
- Runs offline by default
- Readiness evidence, not a certificate