01 / TrustFlare AI Security Agent
Every merge request gets a security review.
The agent comments while the code is still fresh.
Same merge request. Without the agent: Merged unread. With the agent: Reviewed before merge.
Without the agent: Merged unread. With the agent: Reviewed before merge.
02 / In the merge request
Findings appear as comments in the merge request.
The developer sees the problem before merge. No extra report. No new portal.
Developer
Opens a merge request
Agent
Reviews the changed code
Developer
Fixes it before merge
03 / What the change does
The agent reads what the change does.
A SAST rule looks for known patterns. The agent follows the logic of the change.
Broken access check
A removed line lets a user read other users' orders.
Missing role check
A new endpoint skips the permission check.
Path traversal
A new parameter changes which file the server opens.
04 / Clear findings
Each finding explains the attack and the fix.
The input, the code and the impact are in one comment.
We measure false positives and tune the agent in daily use.
05 / Your experts
Your AppSec team spends its time on the hard changes.
The agent takes the first pass on every change. People take the risky ones.
The agent
- Every merge request
- Routine security checks
- Comments for developers
Your AppSec team
- High-risk changes
- The final decision
- Our experts, if you want help
06 / Your workflow
Works with GitLab. No AppSec platform needed.
Connect your repositories. Findings go to merge requests and your tracker.
Optional: connect Whitespots for a shared AppSec workflow.
07 / Security data lake
We build a data lake for your security team.
Code, tickets, assets and logs in one place. The agent and your team decide with full context.
Your storage, your data, without SIEM prices for every gigabyte.
Questions
A few things to know
Does it replace our SAST?
No. Keep SAST for known patterns. The agent adds a reviewer.
Does it block merges?
No. It comments. Your project decides what is required.
Does a clean review mean the code is safe?
No. An empty review is not proof. High-risk changes still need a person.
Which Git platform?
GitLab merge requests. Ask us about others.
Do you use it yourselves?
Yes. Our team uses it on our own product changes.
Where does our code go?
The agent runs inside your network. It sends code for review to the model you choose: Anthropic, OpenAI or xAI.
Try the AI Security Agent
A few repositories. Real merge requests.
Connect a few repositories. Count the findings your developers fix.