tatusec

Find the flaws in your code before they become incidents.

TatuSec reads your code with read-only access and scans code, dependencies, secrets and infrastructure as code, mapping each finding to LGPD (Brazil's data protection law) and ISO 27001. Technical evidence, not compliance.

See how it works

Free plan to get started. No sales call.

How it works

  1. 01

    Connect your code

    Grant read-only access, including to infrastructure as code. You choose what goes in.

    connect --read-only
  2. 02

    Scanning runs in the background

    No pipeline to set up. On every change, TatuSec checks again.

    scan --repo your-code
  3. 03

    Fixes, if you want them

    Every finding is explained in Portuguese, with a suggested fix. Fix PRs are optional and require a separate write permission.

    fix --open-pr

What we check

  • SAST

    Code

    Flaws in the code your team writes: injection, weak authentication, misused cryptography.

  • SCA

    Dependencies

    Libraries with known vulnerabilities, and the path to the fixed version.

  • Secrets

    Exposed secrets

    Keys, tokens and passwords that ended up in the code, including in its history.

  • IaC

    Infrastructure as code

    Terraform, CloudFormation, Dockerfiles and manifests with insecure settings.

Mapping to LGPD and ISO 27001

Each finding points to the related LGPD and ISO 27001 controls, in a format that engineering, the DPO and the auditor can all use.

This is technical evidence. TatuSec does not issue compliance opinions and does not replace your DPO, your auditor or your legal counsel.

Illustrative finding (output is in Portuguese)

severity
alta
tipo
segredo exposto
onde
config/settings.py:14
relacionado
LGPD (segurança) · ISO 27001 (controle de acesso)
correção
revogar a chave, mover para um gerenciador de segredos

Roadmap

No dates for what has not been released.

  • > scan --repo your-code in developmentYour code, including infrastructure as code. First to ship.
  • > scan --cloud aws pilotYour AWS account's configuration, through a read-only role. Azure comes after.
  • > scan --domain your-domain.com coming soonDomains and what is exposed to the internet.
  • > scan --cluster prod coming soonKubernetes clusters.

Security and privacy

What TatuSec accesses, what it stores and where.

Access
Read access to your code, including infrastructure as code. Read-only by default; fix PRs are optional and require a separate write permission.
Code
Your code is not stored beyond the scan run.
Cloud
In the AWS scan we read configuration, not the contents of your data (S3 objects, database rows).
Where data lives today
The site runs on Cloudflare and currently has no forms or cookies. Before any customer sends data, we will publish where it is stored and who the subprocessors are.

Pilot program

We are opening 10 spots for teams that want cloud scanning (AWS first) and code scanning ahead of everyone else. In return, we ask for direct, candid feedback.

I want to be a pilot

Frequently asked questions

Does TatuSec make my company compliant with LGPD?

No, and be wary of anyone who says it does. TatuSec delivers technical evidence about your code and infrastructure. Compliance is an organizational process involving your DPO, your legal team and your auditor.

Do you store my code?

Not beyond the scan run.

Do I need to give write access to my code?

No. Scanning is read-only. Fix PRs are optional and require a separate write permission, which you can choose never to grant.

How much does it cost?

There will be a free plan to get started. Paid plans are not defined yet.

When does it open?

There is no date yet.

What language are the findings in?

Portuguese, with commands and code snippets always in English, as in your terminal.