Aikido Security

Aikido Code scans source code and infrastructure-as-code before changes are merged. It also lists secrets detection in IDE, CI and Git workflows. Pilot a repository with safe, non-sensitive fixtures and check which languages, branches and pipeline events the selected plan scans.

Dependency scanning covers known vulnerabilities, malware, licensing and end-of-life issues. Reachability context helps order the findings, but should not automatically close a security review. Inspect one direct and one transitive dependency and confirm the suggested remediation with the application owner.

Aikido Cloud describes misconfiguration, VM and container-image checks across connected providers. Cloud Search lets a reviewer inspect assets and relationships; the platform also describes links from code findings to containers, cloud assets and internet exposure. Test those links with a known deployment before using them to set priority.

Aikido Protect is the runtime component for observing and blocking malicious requests. A buyer should confirm whether it is included, where it runs, how rules are tested and what happens when it blocks a legitimate request. Public performance and prevention claims should not replace an environment-specific rollout check.

The vendor says scans use read-only repository access, while proposed fixes can arrive as pull requests for a team to review and merge. Preserve normal approvals and tests, then rescan or verify the deployed result rather than treating an offered patch as a completed fix.