Introduction
dagsec finds the supply-chain problems that code review misses, and reports them on the pull request before it merges:
- Leaked secrets. API keys, tokens and private keys committed anywhere in the repository's git history, including ones deleted later. See Leaked secrets.
- Known vulnerabilities. Every package version your lockfiles pin, direct and transitive, checked against OSV.dev. See Known vulnerabilities.
- Unhealthy dependencies. A 0 to 100 health score for each direct dependency: is it maintained, does it depend on one person, is anyone using it.
- Licenses you don't allow. An optional license policy that fails the check when a dependency is under a blocked license.
- Risky installs by AI coding agents. Agents install packages from memory: versions that were safe when they were trained, and sometimes names that don't exist. dagsec checks each install before it runs. See Claude Code, Cursor and Gemini CLI.
Ways to use dagsec
| Where it runs | Best for | |
|---|---|---|
| GitHub App | dagsec server | Every pull request, with no workflow file and no secret to manage |
| GitHub Action | Your GitHub runner | Teams whose code must never leave their CI |
| GitLab CI | Your GitLab runner | GitLab.com and self-managed GitLab |
| Command line | Your machine or any CI | Other CI systems, local checks |
| Dashboard | dagsec server | Scanning any GitHub repository by URL, SBOM downloads |
| Claude Code plugin, Cursor, Gemini CLI, MCP | Your machine | Stopping AI agents from installing risky packages |
All of them are one product with one account: sign in at app.dagsec.net with GitHub and create an API key.
What a result looks like
A pull request that adds an AWS key and depends on an old lodash gets a failing dagsec check and one comment:
md
## dagsec scan
❌ **Failed**: 1 secret(s), 9 known vulnerabilities (5 critical/high), 0 of 6 dependencies below 40
### Leaked secrets
| Secret type | File | Commit | Value | Fingerprint |
|---|---|---|---|---|
| AWS access key ID | `config/deploy.env:1` | `3f2a9c1d7e` | `AKIA********` | `aws-access-key-id:3f2a9c1d7e04:config/deploy.env:1` |
### Known vulnerabilities
| Package | Installed | Upgrade to | Vulnerabilities |
|---|---|---|---|
| `lodash` | 4.17.4 | 4.18.0 | 1 critical, 3 high, 4 moderate |The comment is updated on every push instead of piling up. The full format is in Report format.
What passes and what fails
A scan fails (red check, exit code 1) when any of these is true:
- A secret was found in application code. Secrets in tests, docs and examples are listed but don't fail. See where a secret is.
- A pinned package version has a critical or high severity vulnerability.
- A direct dependency's health score is below the threshold (
fail-under, default 40). - A direct dependency uses a license your license policy blocks.
Otherwise it passes. Moderate and low vulnerabilities are reported but never fail a scan.