Open source · Apache 2.0

One engineer's standards.
Every team's pipeline.

Enforce your DevSecOps standards across every repository — secrets scanning, SAST, SCA, container security, and a policy-as-code gate. GitHub Actions and GitLab CI. One command to start.

Get started → View on GitHub

bash

$ pip install castops

Collecting castops… ✓

$ cast init

🔍 Detected: Python · GitHub Actions

Writing .github/workflows/devsecops.yml

✓ Secrets Detection Gitleaks

✓ SAST Semgrep

✓ SCA pip-audit

✓ Container Security Trivy

✓ Code Quality Ruff

✓ Security Gate conftest + OPA

🛡️ Pipeline installed. Push to activate.

What you get

Every layer of the security stack.
Out of the box.

Each CAST pipeline runs 5 parallel jobs, followed by a policy-as-code gate that controls whether a pull request can merge.

🔑

Secrets Detection

Scans your entire git history for leaked credentials, API keys, and tokens — not just the latest commit.

🔍

SAST

Finds security bugs and anti-patterns in your source code using 1,000+ open-source rules, with SARIF upload to GitHub Security.

📦

SCA

pip-audit · npm audit · govulncheck

Detects known CVEs in your dependencies. Stack-appropriate tool is selected automatically.

🐳

Container Security

Scans your Docker image for OS and library CVEs. Skipped automatically if no Dockerfile is present.

✏️

Code Quality

Ruff · ESLint · staticcheck

Enforces code style and quality standards. Informational — does not block merges by default.

🚦

Security Gate

Evaluates all SARIF findings against versioned policies. Blocks merges on critical findings. Policies live in your repo.

How it works

From zero to production pipeline
in under five minutes.

Install the CLI

One pip install. Works with Python 3.9+. No external accounts or API tokens required.

pip install castops

Run cast init

CAST detects your stack and CI platform, then writes the workflow file to the right place.

cast init

Push and ship

Every push and pull request now triggers the full security pipeline. Findings block unsafe merges.

git push

Templates

Every stack. Both platforms.

All templates include the full 6-layer security stack and are tested on every CAST release.

Stack	SCA Tool	Quality Tool	GitHub Actions	GitLab CI
🐍 Python pyproject.toml · requirements.txt · setup.py	pip-audit	Ruff	✓	✓
⬡ Node.js package.json	npm audit	ESLint	✓	✓
🐹 Go go.mod	govulncheck	staticcheck	✓	✓

Extensible

Bring your own tools.

CAST's gate speaks SARIF — the universal security findings format. Any tool that outputs SARIF slots into the pipeline automatically. No forks. No rewrites.

Replace pip-audit with Snyk. Add Bandit alongside Semgrep. Bring your internal compliance scanner. The gate evaluates everything.

Plugin guide →

custom-snyk.yml — drop alongside CAST workflow

jobs:
  snyk:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: snyk test --sarif-file-output=snyk.sarif
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      - uses: actions/upload-artifact@v4
        with:
          # CAST gate picks up any cast-sarif-* artifact
          name: cast-sarif-snyk
          path: snyk.sarif

One engineer's standards. Every team's pipeline.

Every layer of the security stack.Out of the box.

From zero to production pipelinein under five minutes.

Every stack. Both platforms.

Bring your own tools.

Ship secure code, starting today.

One engineer's standards.
Every team's pipeline.

Every layer of the security stack.
Out of the box.

From zero to production pipeline
in under five minutes.