Cloud applications begin long before they reach the cloud. Source code, open-source dependencies, infrastructure definitions, container images and pull requests all shape what will eventually run in production.
Yet these layers are often secured separately. Software Composition Analysis (SCA) tools inspect dependencies, Infrastructure as Code (IaC) scanners inspect configuration files, container scanners inspect artifacts and cloud platforms inspect deployed resources. Each tool may find valid risks, but the relationships between those risks are easily lost.
Upwind Code is built around a different premise: code and production are two states of the same system.
Security feedback should explain the change
A pull request is one of the few places where intent, implementation and ownership remain connected. It is therefore the right place to explain the security impact of a change.
Traditional image scans often show every known vulnerability, including issues that existed before the pull request. This mixes historical security debt with risks introduced by the developer’s current work.
Upwind Code Noise Reduction in Pull Request Image Scans focuses feedback on the difference between the proposed image and the main branch. Pull-request comments show newly introduced and resolved vulnerabilities, group them by severity and update as the code changes.
This does not hide risk. It gives developers a clear and actionable answer to the question that matters during review: what did this change introduce?
Source dependencies and images require different context
A dependency declared in source code is not always the package that reaches the final container. Build scripts, dependency resolution and base images can all change the resulting artifact.
The released SCA Page Uplift – Purpose-Built Views for Source Code and Container Images separates these two security objects. Source-code findings are presented with repository and commit context, while image findings reflect what was actually packaged.
Version comparisons, commit-aggregated scan history and a richer lifecycle graph help teams understand when a vulnerable package appeared, how it changed and whether it reached the application image.
This gives security teams a clearer distinction between development intent and artifact reality.
Upwind IaC scanning secures cloud architecture before deployment
Infrastructure as code is not simply deployment configuration. It defines the application’s network exposure, identities, encryption, workload isolation and access to cloud services.
That makes IaC a core part of the application’s security architecture.
The generally available Infrastructure as Code Security provides Upwind IaC scanning for Terraform and Terraform modules, CloudFormation, ARM templates, Bicep, Helm and Kubernetes YAML. It includes more than 600 rules across AWS, Azure, Google Cloud and Oracle Cloud Infrastructure.
Automatic pull-request scanning identifies risky infrastructure changes before deployment. A dedicated Scan Reviews experience supports investigation, while exclusion logic helps teams account for intentional architectural decisions. Warning-based enforcement allows organizations to introduce security policy without immediately blocking development.
The purpose of Upwind IaC scanning is not simply to find another misconfiguration. It is to explain the cloud impact of a code change while the engineer who made it can still act.
Repository coverage must work across the enterprise
Large organizations rarely operate a single Git environment. They may use GitHub, GitLab and Bitbucket across different teams, subsidiaries and regulatory boundaries.
GitLab Self-Managed Support extends Upwind Code to enterprises that keep source control within their own perimeter. These teams receive the same IaC and SCA coverage across merge requests and default branches without moving their repositories to a hosted service.
The Bitbucket Cloud Integration (currently in beta) brings automatic IaC and SCA scanning to Bitbucket workspaces, including pull-request feedback for infrastructure misconfigurations.
Git Integrations and Code Environment Management also introduces streamlined GitHub App and GitLab OAuth connection workflows, together with a centralized Organizations & Repositories control plane.
Security teams can view organizations, groups and repositories hierarchically, check connectivity, manage scanning scope, enable or disable coverage in bulk and start scans on demand. Repository security becomes an enterprise control rather than a collection of independent CI configurations.
Moving from visibility to prevention
Security findings matter most when they can influence engineering decisions.
An upcoming enhancement, Pull Request Blocks, will allow organizations to move beyond warnings and prevent changes that violate defined security policies. Enforcement can then be applied according to factors such as severity, repository purpose and organizational risk tolerance.
Additionally, Secret Scanning, another upcoming enhancement will extend Upwind Code to credentials and tokens committed inside repositories. Because exposed secrets can provide direct access to cloud services, detecting them close to the original change is critical.
Both capabilities follow the same principle: identify risk while ownership is clear and remediation remains straightforward.
One security model from code to cloud
Cloud security cannot depend on isolated scanners operating at different stages.
Teams need to understand what developers declared, what the build system produced, what the pull request changed, what infrastructure was configured and what ultimately runs in the cloud.
- SCA Page Uplift: Purpose-Built Views for Source Code and Container Images separates source intent from the final artifact.
- Upwind Code Noise Reduction in Pull Request Image: Scans focuses developers on the impact of each change.
- Infrastructure as Code Security: Upwind Code brings Upwind IaC scanning into the development workflow.
GitLab Self-Managed Support, Bitbucket Cloud Integration, and Git Integrations and Code Environment Management extend that model across enterprise repository environments.
With upcoming Pull Request Blocks and Secret Scanning, Upwind Code will continue moving security closer to the decisions that shape production.
Code shows what an organization intends to build. The cloud shows what it actually built. Effective security requires a continuous understanding of both.
