Musha Security Documentation
Musha reviews every pull request for vulnerable dependencies, insecure infrastructure code and leaked secrets, and also scans the whole repository on a schedule you choose. Nothing is installed in your infrastructure.
What Musha scans
| Scanner | What it finds |
|---|---|
| SCA | Known vulnerabilities in the dependencies you use |
| IaC | Misconfigurations in Terraform, CloudFormation, Kubernetes manifests and Dockerfiles |
| Secrets | Hardcoded credentials, API keys and tokens |
See Scan types for ecosystems, formats and how to suppress a false positive.
Where to start
Quickstart
Create a project and scan your first pull request.
Integrations
GitHub Actions, GitLab CI, Azure DevOps and Bitbucket Pipelines.
Concepts
Scan types, vulnerability states, SLA and technical debt.
API reference
The credentials CI uses and how to create a scan.
How it works, in short
- Your CI job uploads the code of a pull request, authenticated with OIDC or a project-scoped key.
- Musha scans it and comments on the pull request with the findings.
- If something the pull request introduced is above your threshold, the scan is blocked. Pre-existing findings are kept as technical debt and don't block.
- Optionally, Musha also scans the whole repository on a daily or weekly schedule and keeps a backlog.
For the detail, see How it works.
Need help?
Email support@mushasec.com and include the X-Request-ID header of any failed API response: it lets us find the exact request immediately.