Security testing that runs in the pull request
SARIF output, inline PR annotations and configurable merge blocking bring findings to the engineer who wrote the code, at the moment they can still change it cheaply.
- Version
- 3.0
- Released
- January 21, 2026
- New features
- 4
- Category
- Workflow
What's new
Features and improvements in this update
New features
4SARIF output
Results are emitted in SARIF 2.1.0, so GitHub code scanning, GitLab, Azure DevOps and any SARIF-aware tool render findings natively without a custom parser.
Pull request annotations
Findings appear as inline comments on the changed lines, with the evidence and the fix guidance in the thread rather than behind a link to a dashboard.
Configurable merge blocking
Block on new criticals, on any new finding, or on a severity threshold, scoped to the diff so a pre-existing issue elsewhere in the repository does not stop unrelated work.
Diff-scoped scanning
Pull request runs analyse the changed files and their call graph rather than the whole repository, which is what keeps a per-PR scan inside a few minutes on a large codebase.
Improvements
2Baseline import
An existing backlog can be imported as a baseline so the gate applies to new findings from day one, rather than requiring the backlog to be cleared before the gate can be turned on.
Exit codes and machine-readable summaries
The CLI returns structured exit codes and a JSON summary, so a pipeline can make its own decision without scraping log output.
Benefits
What it changes for you
Stated as work removed rather than capability added, the only version of a benefit that can be checked.
Fixes cost less when they happen in the PR
The same vulnerability costs minutes in review and days once it has shipped and been built on. Moving detection into the PR is the whole of the saving.
A gate teams can adopt without a cleanup project
Baseline import means the gate starts working on the day it is enabled instead of after a quarter of backlog work.
No new dashboard to check
Findings arrive where engineers already are. Adoption problems with security tooling are usually location problems.
Upgrade
Getting it
Getting this update
Available from 3.0.0 with GitHub Actions, GitLab CI and Azure Pipelines templates. Requires a token with permission to write checks and PR comments.
pip install --upgrade aiptxRelated
Other updates
Active Directory and OSINT, in the same assessment
Internal path enumeration and external footprint discovery join the same engine, so the route from a leaked credential to a domain controller is one graph rather than two reports.
ReadBusiness logic testing, as a first-class scan type
Twenty-nine abuse patterns (race conditions, IDOR, price manipulation, workflow bypass) now run as their own scan phase, against the class of flaw that has no CVE and no signature.
Read90+ SAST rules across Python, JavaScript, Java and Go
Static analysis with rules written against real exploit conditions rather than pattern matches, wired to the same validation and ranking as everything else.
ReadSee Your Attack Surface in Real-Time
Run a comprehensive VAPT assessment powered by advanced security tools. Get actionable findings in hours, not weeks. No credit card required.