Code Security
Vauban is application security for the code of small and medium-sized businesses in France and Europe. It reads your repositories on GitHub, GitLab and Azure DevOps, grades each one from A to F, writes its action plan, and checks every pull request in your CI. Vauban is in its pilot stage.
Code Security
Vauban reads the code of the repositories you connect and shows what is exposed: flaws in your own code, leaked secrets, vulnerable dependencies and risky configuration. For each repository it turns the findings into a grade from A to F and an action plan, and the decisions your team records apply to the next scans and to the check on every pull request.
A small team knows what its code exposes and what to fix first, keeps control of every decision, and catches a new flaw at the pull request rather than in production.
In every plan
Solo and Team run the same analyses on every scan. The Team plan adds the agentic AI review and higher quotas.
Static analysis of your code (SAST), and leaked secrets reported by where they are and by the rule that found them, with the value masked in whole or in part. Treat any secret Vauban reports as exposed: revoke it and replace it.
Dockerfiles, Terraform files and the configuration of your CI are analysed with the code.
Known vulnerabilities in your dependencies, each with the fixed version, the known-exploited marker and the EPSS probability. Reachability shows whether your code actually reaches a vulnerable dependency. The images the repository builds and the base images it declares are checked as well.
Components grouped by licence family, and your decision recorded on each licence they carry. The SBOM exports in CycloneDX 1.6 and SPDX 2.3. A licence identified by Vauban is not legal advice: the decision stays yours.
A security grade from A to F for each repository, an action plan, the comparison with the previous scan, and trends over time. Each repository you follow is scanned every day, and those scans do not count against your quota. Performance and privacy findings are listed as well, outside the grade.
On full repository scans, likely false positives are sorted out automatically. A person's decision outranks that triage, and the decisions and exceptions your team records are shared by everyone who proves access to the repository, and applied to the pull-request check.
AI explains each finding, and the assistant answers your questions about it and suggests a fix. Each user can have both served by their own AI provider, configured in Vauban.
Repositories on GitHub, GitLab and Azure DevOps. API tokens for your CI, a check on pull requests and branches, and SARIF export for the tools you already use.
The Team plan
Everything in the Solo plan, a security review by AI models, and more room every month.
AI models look for authentication bypass, authorization flaws, broken tenant isolation, prompt injection, remote code execution, unsafe evaluation and cryptography flaws. Each finding is backed by a cited file and its evidence. Ten reviews a month in the Team plan.
500 scans, 1,000 pull-request and branch checks and 300 AI explanations a month, against 100, 400 and 50 in the Solo plan.
Pilot stage
Vauban is in its pilot stage. Most of its features are live. These are the ones that are live with a limit, the one that is coming, and what is not there yet.
The shell steps of a pipeline are checked. The other hygiene rules of a pipeline are not reported yet.
Available for JavaScript and TypeScript, Python and Go.
Only the images the repository builds and the base images it declares are checked.
On full repository scans only. A person's decision outranks it.
The verdict is the exit code of the CI step. Nothing is posted on the pull request.
Built, and not yet published for installation.
Single sign-on for your company's users, team and user management, and comments or assignments on findings are not part of Vauban today.
Plans and prices
Four plans, for professionals and companies only. Prices are per month and exclude VAT. Online subscription is not open yet, so every plan starts with a conversation with our team.
Solo
€39per month, excluding VAT
For one developer or consultant. Every feature of Vauban, except the agentic AI review.
Team
€149per month, excluding VAT
For the person who looks after a team's code: everything in the Solo plan, higher quotas and the agentic AI review.
Business
From €590 per month, excluding VAT
For a company with more code and more people. Sold on quote only, never online.
Enterprise
On quote
For a company whose quotas, users and terms are set in a contract of its own.
Quotas are monthly and do not carry over. Nothing is billed beyond a quota: when a plan runs short, you move up to the next one. Scans count against the plan of the person who starts them, and a scan started with an API token against the plan of the person who created that token.
How it works
Four steps, and the fourth runs on every pull request.
Add a repository from GitHub, GitLab or Azure DevOps with an access token. Give the token the narrowest rights the features you use need, and an expiry date where your provider allows one.
Start a scan from Vauban. The code is read in an isolated environment that is deleted at the end of the run, and every repository you follow is scanned again each day.
Each repository gets a grade from A to F and an action plan. AI explains each finding, the comparison with the previous scan shows what changed, and your team's decisions carry over to the next scans.
Create an API token in Vauban and add the CI step its guide describes. Each pull request or branch is checked against your decisions and exceptions, and the verdict is the exit code of that step.
Vauban posts nothing on your pull requests. Your pipeline reads the verdict, and your branch rules decide whether a merge goes ahead.
Built for
One person and the repositories they look after: a grade, the list of what to fix first, and a check on every pull request.
A business without a security team of its own sees what its code exposes and what to fix first, explained in plain words.
Decisions and exceptions recorded once apply to everyone who proves access to the repository, and to the check in the CI.
Why Vauban
Named after Vauban, Louis XIV's military engineer, who fortified the borders of France and led many of the sieges of his time. He knew where a wall gives way because he had taken so many. Application security works the same way: code is best defended by reading it the way an attacker would.
Vauban is written first for small and medium-sized businesses that need to know what their code exposes without building a security team to find out.
Its findings help your team decide; they are not an audit or a certification. An analysis can report a problem that is not there, or miss one that is, which is why the decision always stays with a person.
Your own code, your dependencies, your configuration and the secrets left in them are read together, so one weak point does not hide behind another.
Likely false positives are set aside, and every decision your team takes carries over to the next scan and to the pull-request check.
Your data is processed in the EU, and the default AI models run in the EU data zone.
Neither your code nor the results are used to train AI models. Results, with the code excerpts they quote, are kept while you follow the repository.
Online subscription is not open yet. Meet an expert: we answer your questions and set you up on the plan that fits.
Meet an expert