CI/CD Security · Automated

Security Gate in
Every Pipeline

Automated compliance checks that run on every PR. Catch HIPAA violations, leaked secrets, vulnerable dependencies, and access control gaps before they reach production.

View GitHub Actions Config Browse Compliance Pack

Security Checks

Frameworks

<5m

Pipeline Time

Config Required

Pipeline Architecture

How It Works

Every push triggers a security gateway. Compliance skills run as structured audits between your CI and deployment stages.

Developer
Push

CI
Triggers

Security Gateway

Framework Compliance

hipaa-audit gdpr-audit soc2-audit pci-audit

Infra Security

cloud-security infra-harden network-audit

Code Security

secrets-scan dep-vuln privacy-review access-audit audit-log

Reporting

incident-plan compliance-report

Build
& Test

Deploy

Tool Support

Works With Your Tools

Drop compliance skills into your existing workflow. No vendor lock-in, no proprietary agents.

Claude Code CLI

Run compliance skills directly from your terminal or CI pipeline via Claude Code. Each skill runs as a structured prompt with expert-level auditing.

GitHub Copilot

Use skills as Copilot custom instructions. Drop SKILL.md files into your repo and Copilot references them during code review and suggestions.

Cursor IDE

Import skills as Cursor rules. Get real-time compliance guidance while writing code, with inline suggestions based on HIPAA, GDPR, SOC 2 rules.

Configuration

Drop-In GitHub Actions

Copy this workflow into your repo. Security scans run on every PR, framework audits on release branches.

.github/workflows/security-gateway.yml

1name: Security Gateway
2on:
pull_request:
  branches: [main, staging]
5
6jobs:
compliance-scan:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
11
    - name: Install Claude Code
      run: npm install -g @anthropic-ai/claude-code
14
    - name: Run Security Gateway
      env:
        ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      run: |
        claude -p "Run /secrets-scan on this codebase" --output-format json > results/secrets.json
        claude -p "Run /dep-vuln on this codebase" --output-format json > results/deps.json
        claude -p "Run /sec-audit on this codebase" --output-format json > results/security.json
        claude -p "Run /privacy-review on this codebase" --output-format json > results/privacy.json
23
    - name: Framework Compliance (on release branches)
      if: github.base_ref == 'main'
      run: |
        claude -p "Run /hipaa-audit on this codebase" --output-format json > results/hipaa.json
        claude -p "Run /gdpr-audit on this codebase" --output-format json > results/gdpr.json
        claude -p "Run /soc2-audit on this codebase" --output-format json > results/soc2.json
30
    - name: Generate Compliance Report
      run: claude -p "Run /compliance-report for this PR" > results/report.md
33
    - name: Post Results to PR
      uses: actions/github-script@v7
      with:
        script: |
          const fs = require('fs');
          const report = fs.readFileSync('results/report.md', 'utf8');
          github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: '## Security Gateway Report\n\n' + report
          });

Full Coverage

14 Security Checks, Every PR

Each check runs as a structured audit with expert-level analysis. Results are machine-readable JSON for pipeline integration.

Skill

What It Catches

Frameworks

When It Runs

secrets-scan

API keys, tokens, passwords in code & git history

All

Every PR

dep-vuln

CVEs in dependencies, license violations, supply chain risks

All

Every PR

sec-audit

OWASP Top 10, injection, XSS, broken auth

All

Every PR

privacy-review

PII in logs, unencrypted data, third-party leaks

GDPRCCPAHIPAA

Every PR

access-audit

Missing RBAC checks, privilege escalation, orphaned accounts

SOC 2HIPAAPCI

Every PR

audit-log

Missing audit events, PII in logs, retention gaps

SOC 2HIPAAPCI

Every PR

cloud-security

Public S3, overpermissive IAM, unencrypted volumes

CISSOC 2

Infra changes

infra-harden

Root containers, missing TLS, unpatched images

CISPCI

Infra changes

network-audit

Open security groups, missing WAF, egress gaps

CISPCI

Infra changes

hipaa-audit

PHI exposure, missing encryption, BAA gaps

HIPAA

Release branch

gdpr-audit

Consent issues, missing rights, cross-border transfers

GDPR

Release branch

soc2-audit

Control gaps, missing evidence, access review failures

SOC 2

Release branch

pci-audit

CDE scope issues, tokenization gaps, log retention

PCI-DSS

Release branch

compliance-report

Generates auditor-ready evidence package

All

Release branch

Impact

Before vs After Security Gateway

The difference between manual security reviews and automated compliance gates.

Without Security Gateway

Secrets in git history discovered 6 months later
CVEs in dependencies found by customers
HIPAA violations caught during audit
Manual compliance evidence collection before every audit

With Security Gateway

Secrets blocked before they enter git
CVEs caught on every PR, patches enforced by SLA
HIPAA compliance verified on every release
Automated compliance reports generated on demand

Security Gate inEvery Pipeline

How It Works

Works With Your Tools

Drop-In GitHub Actions

14 Security Checks, Every PR

Before vs After Security Gateway

Add Security Gates to Your Pipeline Today

Security Gate in
Every Pipeline