Solutions

See the same failure class across every repo.

You work across teams, in repos you do not own. One finding is a bug. The same finding in six repos is an architecture problem, and it is yours.

Compliance postureTeams view
Controlcheckoutpaymentsplatform
SLO-Tied AlertingRC-001 · detective2
Synthetic MonitoringRC-002 · detective1
Alert Noise ReductionRC-004 · corrective975
On-Call CoverageRC-005 · preventive2
Incident RunbooksRC-006 · preventive4

Example data. A lit row is one failure class that recurs across teams. A lit column is one team with many.

“Revelara has uncovered some terrifying/juicy findings. There were certainly surface level findings, but also way way deeper than I would have gotten, even with multiple human review passes. Critically, it's not just telling me the problem, but I can already start to see the matrix beyond it as the same failure class is highlighted across multiple disparate repositories.”

Principal Engineer, ex-Amazon/ex-Google

Scan repos you cannot commit to

Ownership is declared in each repo, in .revelara.yaml. When you map repos that you do not own, you do not need a pull request first: rvl scan --team= applies your mapping for that submission.

It is recorded as an override. When the owning team commits their own declaration, their scan takes over.

.revelara.yaml
project: checkout-api
team: checkout # repo-level default
components:
- name: billing-worker
path: worker/billing/
team: payments # overrides the repo default
# a repo you cannot commit to
$ rvl scan --team=checkout --target ../some-teams-repo

Read the matrix by row

The compliance matrix switches between Teams, Teams then Services, and Services. Each cell is a severity-weighted count of open risks for that control and team. A lit row is one failure class that recurs across many teams, which is the signal that a shared library or a platform default is the real fix.

PlanPer-team views start at the Plus plan. See pricing.

Go deeper than review can

Correlate finds the low-severity risks that combine across services. Architect adds STPA-inspired hazard analysis, with loss scenarios that state how each hazard would trigger. Both are depths that you add to any plan.

Run your first scan free.

Install the CLI, scan a repo, and read the findings in your terminal. Your source code stays on your machine.