Register a repository, add a webhook. Bearer, OWASP Dependency-Track, KICS and gitleaks then run on every push — and their findings arrive normalized and deduplicated in a single view.
docker-compose up
three containers, on your own box
Flow does not reinvent detection. It orchestrates established open-source scanners, keeps their configuration consistent across repositories, and merges their output into one schema.
| Layer | Engine | Detects | Requires |
|---|---|---|---|
| SAST | Bearer | Injection flaws and insecure patterns in your own source code. | nothing — runs on every change |
| SCA | OWASP Dependency-Track | Known CVEs, licensing issues and outdated libraries, via SBOM ingestion. | sbom.json in the repo root |
| IaC | KICS | Misconfiguration in Terraform, Kubernetes manifests, Dockerfiles and other templates. | nothing — runs on every change |
| Secrets | gitleaks | API keys, tokens and passwords committed by accident. | nothing — runs on every change |
| Platform | Mixeway GitLab ruleset | 15+ GitLab repository and CI/CD misconfigurations — the layer code scanners ignore. | read access to project settings |
A curated ruleset queries repository metadata, CI settings and protection rules, then reports policy gaps with remediation guidance. A sample of what it catches:
Scans are triggered by Git events, not by YAML you have to maintain in every repository. Nothing about your build changes.
Provide the URL and an access token. An initial scan runs against the latest commit on the default branch.
Point a GitHub or GitLab webhook at Flow. Every push, pull request and merge request triggers a scan; events queue when they arrive faster than they run.
Review findings in one dashboard, filter to your branch or team, and suppress by context so the same noise does not come back next week.
Five tools produce five formats. Flow normalizes them into one record type, so a finding means the same thing regardless of which scanner raised it.
We are building an AI-assisted layer that decides whether a finding is actually exploitable in your repository, not merely present. It is in active development and will ship in a future release — we would rather say that than imply it is ready.
The SAST, SCA, IaC and secret-scan output that Flow already collects and deduplicates.
CVE and CWE metadata, CVSS, known-exploited catalogues, exploit-probability signals and advisories.
A constraint checklist per finding — reachable sink, untrusted data flow, missing validation, vulnerable version actually called — mapped to concrete files, functions and execution paths.
Want to test it early? Open an issue on GitHub or say hello on Discord .
Self-hosting is the default deployment model: the code, the scanners and the findings all stay inside your network.
docker-compose up
Postgres, a backend bundling Dependency-Track, and an nginx frontend. Nothing leaves your infrastructure.
flow.mixeway.io
A running instance for evaluating the interface and the workflow before installing anything.
Talk to us
Rollout support, integration work, licensing for larger estates, and the training and consulting below.
# 1 — bring the stack up
$ git clone https://github.com/Mixeway/flow
$ cd flow
$ docker-compose up
# 2 — open the app and rotate the default credentials
→ https://localhost:443
# 3 — create a team, import a repository, register the webhookThe bundled certificates are self-signed and the default credentials must be changed on first login — fine for a local trial, not for anything shared.
A self-hostable Application Security Posture Management (ASPM) platform. It does not detect vulnerabilities itself — it registers your Git repositories, runs established open-source engines on every push through a Git webhook (Bearer for SAST, OWASP Dependency-Track for SCA, KICS for infrastructure as code, gitleaks for secrets), and normalizes and deduplicates everything they report into one triage queue. A fifth, in-house ruleset audits GitLab repository and CI/CD configuration rather than application code.
Not in the self-hosted deployment, which is the default model. You run the whole stack — database, backend, scanners and frontend — with Docker Compose inside your own infrastructure. The hosted instance at flow.mixeway.io exists so you can evaluate the interface without installing anything.
Bearer for SAST, OWASP Dependency-Track for SCA via SBOM ingestion, KICS for infrastructure as code and gitleaks for secrets. A fifth, Mixeway's own ruleset, audits GitLab repository and CI/CD configuration. All four external engines are open source and linked from this page, so you can read exactly what they check.
No. Scans are triggered by Git webhooks on push, pull request and merge request events, so there is no per-repository pipeline YAML to write or maintain. SCA is the one exception that needs something from you: an sbom.json in the repository root.
No, and we would rather be explicit about it. The exploitability-verification layer described above is under active development and will arrive in a future release. What ships today is orchestration, normalization, deduplication and context-based suppression. If you want early access to the verification work, open a GitHub issue or find us on Discord.
The source is on GitHub under the FlowLicense and you can run it yourself; read the licence for the exact terms. For commercial support, larger deployments or the training and consulting work, pricing depends on scope — book a call and we will give you a number.
Docker and docker-compose, with at least 2 CPUs, 16 GB of RAM and 50 GB of disk; 4 CPUs, 32 GB and 100 GB is the comfortable configuration. The stack starts as three containers: Postgres, the backend bundling Dependency-Track, and an nginx frontend.
Something not answered here? Ask on Discord or book 30 minutes .
Thirty minutes, your code, the actual product. We register one of your repositories, run the engines, and go through what comes back — including the parts that are noise.