ForgeGuard scans your code, dependencies, secrets, containers, IaC, and running apps in one place — then blocks vulnerable pull requests right in your pipeline. Part of the RogueLogics security platform.
No credit card required · 14-day free trial · Connect a repo in minutes
From the dependency tree to the deployed endpoint — ForgeGuard closes the loop from code to CI to compliance evidence.
Resolve your lockfiles and match every dependency against the OSV and GitHub Advisory databases — with the exact fixed version to upgrade to.
Catch leaked credentials, tokens, and keys in the working tree and reachable git history, with every secret value masked in the finding.
Semgrep rulesets find injection, auth, crypto and other code-level flaws in your source — mapped to CWE and ranked by real severity.
Actively test a deployed URL with OWASP-aligned checks — security headers, cookie flags, reflected input, and nuclei templates when installed — with domain ownership verified (DNS TXT / well-known) before any target is scanned. Enterprise adds auth header / cookie injection on the built-in checks.
GitHub, GitLab, and Bitbucket integrations scan pull or merge requests and publish a required status that blocks merges when policy is violated.
SCA, secret, SAST, container, IaC and DAST findings share one de-duplicated list with exploit context, suggested fixes, RogueOne risk rollup, and ClearTrust ASVS evidence.
Scan Dockerfiles and their base images plus Terraform, CloudFormation, and Kubernetes manifests. Trivy adds image CVEs when installed; built-in checks keep configuration scanning available without it.
KEV and EPSS context ranks findings by real-world exploitation, so teams fix vulnerabilities attackers are actively targeting before chasing every CVSS score.
Test AI interfaces, retrieval and agents. Review implementation risks and track regression evidence as models, prompts and tools change.
Assess customer assistants, internal knowledge tools and workflow agents for injection, data leakage, access-boundary failures, unsafe tool actions and resource limits. Connect source and dependency findings to remediation and release decisions.
Evaluate citizen information, departmental retrieval and administrative agents with source, escalation and approval criteria. Organize procurement, impact and human-review evidence for the service owner.
Included at no additional subscription charge with ForgeGuard Pro (5 systems, 50 assessments per UTC month, 2 concurrent, up to 90 days retention) and Enterprise (25 systems, 250 assessments, 5 concurrent, up to 365 days retention). Client assessments require authorized sandbox access, an instrumented adapter and an intended-use dataset. Reports document tested coverage and gaps; they do not provide certification or an authorization to operate.
Cross-app inbox, push, and automatic ClearTrust control mapping are still rolling out for ForgeGuard. The scanners, exploit context, RogueOne risk rollup, and ClearTrust evidence export are available today.
See ForgeGuard's critical findings and failed merge gates alongside every other Rogue Logics app in one cross-platform inbox — and launch your AppSec posture reports from a shared report center.
Opt in to push notifications so a critical finding or blocked pull request reaches you even when ForgeGuard is not open.
GitHub, GitLab, and Bitbucket deliver native pull/merge-request scanning and status gating. Enterprise can also create review-only dependency fix pull requests, and any CI can trigger scans with a CI token. Findings flow to Jira, Slack, Teams, and ClearTrust.
Connect your first repository and get prioritized, fixable findings in minutes.
Start Free Trial →Public-sector program preview
Bring retained application and AI assessment evidence into governance reviews, with explicit coverage and approval boundaries.
Manage state security requirements, supplier and AI reviews, versioned reporting packages and public-records work in one connected program. Support state agencies, counties, cities and schools with explicit applicability decisions.
California SAM, SIMM and Cal-Secure, plus New York, Texas, Virginia and Washington reference packages.
Trace requirements and current evidence into SSP and other supported forms. Preview missing inputs, review the exact edition and preserve earlier exports.
Record vendor qualifications, AI providers and subprocessors. Follow changes into affected services and documents, then share reviewed snapshots with named public or private recipients.
Explore service dependencies, exposures and treatment work. Compare retained briefings and exact retest outcomes while keeping unrelated findings and review decisions separate.
Reference coverage and applicability are explicit. Generated documents need your review. Demonstrations do not establish live-provider qualification or agency approval.