Observed arrival · 2026-10-12
Pitangus files security bugs as specimens
Pitangus is a self-hosted, open-source application security tool that scans code, dependencies, secrets, infrastructure, and images, then tracks findings and fixes.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Small teams maintaining application repositories
- Worth noticing
- It combines seven named open engines, with optional passive checks for websites and APIs using five more.
Field notes
The page presents a CI workflow using a published GitHub Action image and a scan command comparing changes with a base branch. Its ledger examples include finding status, deadlines, risk acceptance, and scan identifiers; it also lists CycloneDX and OpenVEX outputs. The project says the same code, engines, and advisory data produce repeatable results, and says an engine failure prevents findings it covers from counting as fixed.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
One card from the complete issue