Freedom251 › Static Application Security Testing Sast
Xygeni
What Xygeni is
Xygeni is an application security platform for reviewing risks across the software supply chain. Its scanner runs within a customer's network and can inspect directories, repositories, container images, and source-control organizations; findings can be kept locally or sent to a cloud dashboard. Xygeni says source code itself is not uploaded during scanning. The platform checks configuration files, build scripts, and CI job definitions for supply-chain misconfigurations, and audits compliance against standards including OpenSSF Scorecard and CIS Software Supply Chain Security. Secrets Security identifies more than 100 types of secrets and can block commits through Git hooks. The service supports SAML2 single sign-on and provides a REST API for issues, project risk summaries, trends, reports, and administration. Integrations include GitHub, GitLab, Azure DevOps, Bitbucket, Jenkins, Slack, and Jira. It supports ecosystems such as Maven, npm, .NET, Go, Python, Ruby, and Dart/Flutter, along with SBOM generation, reachability analysis, and pull-request scanning. The free plan covers five contributors, up to 10 repositories, and 200 scans per month.
Who it suits
Xygeni is suited to developers, DevOps and DevSecOps teams, and security leaders working on software supply-chain risks. Its local scanner and option to retain findings locally may suit organizations controlling source-code handling.
What it does well
- Scans run within the customer’s network
- Can keep findings locally
- Detects more than 100 secret types
- Free plan includes 200 scans monthly
What to know first
- Free plan is limited to five contributors
- Free plan covers up to 10 repositories
- Free plan caps scans at 200 monthly
Limits
The Free plan includes five contributors, up to 10 repositories, and 200 scans per month. It includes SAST, SCA, Secrets Security, and an IDE plugin; features such as IaC and CI/CD security, container image scanning, DAST, and API Security are listed on paid plans.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Free | 5 contributors · up to 10 repos · 200 scans/mo · SAST, SCA, Secrets Security, IDE plugin | Free |
| Team | $2.160 billed annually · up to 100 repos · unlimited scans · AI SAST autofix · IaC and CI/CD security · container images · SDLC Inventory | On request |
| Business | $2.160 billed annually · up to 300 repos · unlimited scans · real-time OSS malware detection · malicious command detection · SSCS Compliance | On request |
| Enterprise | ASPM third-party data ingestion · DAST · API Security · anomaly detection · Build Security · on-premise · fully configurable | On request |
As xygeni.io lists them, read 1 Oct 2026. The maker's own page has the final word.
Getting started
- Visit the Xygeni website.
- Choose the Free plan, which includes five contributors and up to 10 repositories.
- Use the scanner to analyze directories, repositories, container images, or SCM organizations.
- Choose whether findings go to the cloud dashboard or remain local.
Verdict
Xygeni combines local scanning with supply-chain checks, secrets detection, and compliance audits. Its free tier has clear contributor, repository, and monthly scan limits to consider.
Questions
Does Xygeni have a free plan?
Yes. The Free plan costs nothing and includes five contributors, up to 10 repositories, and 200 scans per month.
Is there a free trial?
Yes, Xygeni lists a free trial.
Which platforms does Xygeni support?
Its listed platforms are API, extension, Linux, macOS, self-hosted, web, and Windows.
Can Xygeni scan without uploading source code?
Xygeni says scans run locally and source code is not uploaded. Findings can be uploaded to its cloud dashboard or kept locally.
Which integrations are documented?
They include GitHub, GitLab, Azure DevOps, Bitbucket, Jenkins, Slack, Jira, and GitHub ticketing.
What is included in the free plan?
It includes SAST, SCA, Secrets Security, and an IDE plugin, with a limit of five contributors, 10 repositories, and 200 scans per month.
Facts from Xygeni's own pages
- API
- The REST API provides security issues, project risk summaries, trends, report generation, and administration endpoints. · docs.xygeni.io, 1 Oct 2026
- CI/CD security
- Xygeni scans configuration files, build scripts, and CI job definitions for supply-chain misconfigurations. · docs.xygeni.io, 1 Oct 2026
- Compliance
- Xygeni performs automated compliance audits against standards including OpenSSF Scorecard and CIS Software Supply Chain Security. · docs.xygeni.io, 1 Oct 2026
- Free trial
- The current Start Free page advertises a 7-day trial with no credit card required and up to 15 repositories and 150 scans per month. · xygeni.io, 1 Oct 2026
- Integrations
- Documented integrations include GitHub, GitLab, Azure DevOps, Bitbucket, Jenkins, Slack, Jira, and GitHub ticketing. · docs.xygeni.io, 1 Oct 2026
- Product
- Xygeni describes itself as an all-in-one AppSec platform that simplifies security across the software supply chain. · xygeni.io, 1 Oct 2026
- Scanner targets
- The scanner can analyze directories, repositories, container images, or SCM organizations. · docs.xygeni.io, 1 Oct 2026
- Scanning architecture
- The Xygeni Scanner runs inside the customer’s network and findings can be uploaded to the cloud dashboard or kept locally. · docs.xygeni.io, 1 Oct 2026
- Secrets security
- Secrets Security identifies more than 100 types of secrets and can block commits through Git hooks. · docs.xygeni.io, 1 Oct 2026
- Single sign-on
- Xygeni supports SSO with third-party identity providers using SAML2. · docs.xygeni.io, 1 Oct 2026
- Source-code privacy
- Xygeni says source code is not uploaded for scanning; scans run locally and only protected results are uploaded. · xygeni.io, 1 Oct 2026
- Target users
- Xygeni lists developers, DevOps and DevSecOps teams, and security leaders as its built-for audiences. · xygeni.io, 1 Oct 2026