Every vulnerability has a cost.
Gerion tells you how much.
Most security tools give you a score. Gerion gives you a budget. One open-source CLI runs SAST, SCA, secrets and IaC scanning inside your pipeline, and the platform turns every finding into an estimated remediation cost in euros. Your code never leaves your CI.
- Open Source CLI
- Your code never leaves your CI
- 🇪🇺 European infrastructure
Four scanners. One platform.
Quantified financial impact.
Gerion integrates reference open-source scanners and normalizes their output into a unified findings model with financial impact metrics.
SAST & SCA
Analyze your source code and open-source dependencies with a single command.
- Python, JS, TypeScript, Go, Java, Ruby + 20 more languages
- OSV.dev, the open database that aggregates GitHub Advisories, PyPA, Go, RustSec and more
- One finding per package, with the version that fixes it
- CWE/CVE metadata when the rule or advisory includes it
- Normalized output with calculated financial impact
Secrets & IaC
Detects exposed credentials in your repository files and insecure configurations in your infrastructure as code.
- KICS audits Terraform, Kubernetes, Dockerfiles, and more
- 150+ secret patterns detected (AWS, Stripe, GitHub…)
Executive Dashboards
Two purpose-built views for different audiences: leadership and engineering managers.
- Executive dashboard: debt, realized savings (YTD) and avoidable cost in €
- Governance dashboard: Security Grade A–F per repository
Financial Impact Engine
Every finding carries a remediation cost in euros. Security debt stops being abstract.
- 10× cost multiplier for findings on production branches
- Debt and realized savings in euros, updated with every scan
- Configurable remediation costs by severity and scan type
- No noise between scans: deduplicates, auto-closes what's gone and flags reopened findings
Sample data using default settings. Hours and rates are configurable.
Analyze every commit,
without slowing delivery.
Gerion's CLI integrates directly into your CI/CD pipeline. A single command runs all four scanners inside your own infrastructure and sends normalized findings — with calculated financial impact — to your dashboards when the scan finishes.
1. Developer pushes a commit
Any CI/CD event triggers Gerion's CLI, which runs as a Docker container (linux/amd64) inside your own infrastructure.
2. Gerion Engine
Four scanners, one sequential analysis. Everything in your network — your code never leaves.
3. Instant results
Findings are normalized, assigned a financial cost, and sent to your dashboards when the scan finishes.
Documented integrations for your CI/CD
- uses: gerion-appsec/gerion-cli-action@v1 with: api-url: ${{ vars.GERION_API_URL }} api-key: ${{ secrets.GERION_API_KEY }}Upload SARIF results to GitHub Code Scanning
Security and control
from day one.
Access and data controls built for teams that cannot improvise with their security information.
SSO with Microsoft Entra ID and Okta
Single sign-on through OIDC with your identity provider.
MFA with TOTP
Second factor with any authenticator app.
API keys with per-scope permissions
Each key accesses only what it needs.
Per-organization isolation
Each organization's data is kept separate from everyone else's.
Data hosted in the EU
The platform is hosted on Hetzner, in Germany.
Auditable open-source CLI
Apache-2.0 licensed: you can review what runs in your CI.
Join Early Access.
Gerion is in early access. Tell us what you need: we either give you access to the platform or set up a free trial with your repositories.
Early access
For teams that want to adopt Gerion now and help shape the roadmap.
- Full platform: SAST, SCA, secrets and IaC with financial impact
- SSO (Entra ID, Okta) and MFA
- Direct contact with the founding team
- Influence on the roadmap
Free trial
Scan your repositories during a no-commitment trial period and see what your security debt costs.
- No credit card
- We help you integrate the CLI into your pipeline
- Debt report in euros at the end
Frequently asked questions
What exactly does the Gerion CLI do?
The Gerion CLI orchestrates four security capabilities from a single command: Static Application Security Testing (SAST) with Opengrep to detect vulnerabilities in your source code, Software Composition Analysis (SCA) with OSV-Scanner to identify CVEs in your open-source dependencies, secrets detection with Gitleaks to find hardcoded credentials and tokens in your repository files, and Infrastructure as Code (IaC) auditing with KICS to detect insecure configurations in Terraform, Kubernetes, and Dockerfiles.
The CLI automatically extracts git metadata (branch, commit, author), normalizes findings from all four scanners into a unified format, and sends them to the platform. The platform handles deduplication, financial impact calculation, and automatic mitigation of resolved findings.
You can run all four analysis types with a single command: gerion scan-all. Or individually for more granularity. The CLI outputs JSON, Markdown, SARIF or table, and you can export to CSV and PDF from the platform.
How does the Financial Impact Engine calculate debt?
Every finding gets an estimated remediation cost: average hours to fix × hourly rate, based on its severity and scan type. If it sits on a production branch (main, master or release*), it is multiplied by 10 — that's what fixing it costs once it's deployed. Hours, rates and the multiplier are configurable per organization. When a finding is fixed, its production cost becomes realized savings.
Does my source code ever reach Gerion's servers?
No. The CLI runs inside your own CI/CD pipeline — all four scanners (Opengrep, OSV-Scanner, Gitleaks, KICS) execute on your infrastructure, not ours. What reaches the platform is finding metadata: severity, type, file path, line number, the rule message, and git and CI metadata.
For secrets, the value is transmitted redacted — the full token never arrives.
The CLI also collects CI/CD system environment variables to identify the workflow context: repository URL, branch name, commit hash, pipeline ID, job name (e.g. GITHUB_REPOSITORY, GITHUB_REF). User-defined environment variables and application secrets are not collected.
Complete source files, business logic, and your repository tree do not leave your network. The CLI is fully open source: you can read exactly what it sends to the API before running it.
To detect CVEs, OSV-Scanner queries the public OSV.dev database with your dependency names and versions — never your code.
Can I self-host the full Gerion stack if I need to?
Gerion is a SaaS service hosted on European infrastructure (Hetzner, Germany). The CLI runs on your own runners and your code never leaves your CI.
If your organization needs a dedicated deployment, get in touch and we will look into it.
Ready to put a price on your security debt?
Gerion is currently in Early Access. If you lead an engineering or security team and want to quantify your security debt and show with data what your team saves, reach out. Early Access teams will work directly with us to shape the roadmap.
Try the open-source CLI on your repo — no sign-up
docker run --rm \ -v "$PWD:/code" \ ghcr.io/gerion-appsec/gerion-cli:latest \ scan-all /code --format tableResults are printed in your terminal; without an API key nothing is sent to the platform.