Feature · Find · Written by Yobel Tzegai · Last checked 20 October 2026

Can we scan our code for AI when GitHub or GitLab is behind a firewall?

In Complipath (complipath.io), a small scanner runs in your own CI, reads the repository where it is and sends only what it found (file, line, AI library or service) to a signed webhook address that is yours, never source code. Its checksum is shown in the app and checked before it runs. It is on Growth, which is not for sale yet, so today it is open to pilots.

Check your AI systems, free

What the app says it does

When your GitLab or GitHub is behind a firewall, a small scanner runs in your own CI on every push and sends only what it found (file, line, AI library or service), never source code, to your own signed webhook; its checksum is shown in the app and checked before it runs.

Illustration · not your dataRepository northlane/candidate-rankingFile and line requirements.txt, line 3Sent openai · a library · vendor OpenAI. No source code.

What it does

You make a webhook address in Complipath and keep its secret. You add the address and the secret to your CI as masked variables.
You copy a template into your CI file: a GitHub Actions workflow, which runs on every push, or a GitLab CI job, which runs when your pipeline does.
The job downloads the scanner and checks its SHA-256 against the value shown in the app. A file that does not match stops the job. The scanner checks its own checksum again when it starts.
The scanner reads the files the app itself would read, skipping vendored code, builds, tests and secret files and posts the result signed with HMAC-SHA256.

What it sends

The repository name, the commit id and, for each file with a match, the path, the line, what matched and the vendor.
What matched is a name, never a value or a line of text: a library, a host, a model id, an AI key's variable name such as OPENAI_API_KEY, or a personal-data field such as email.
Three more signals feed Live's code rules: that code takes messages from people, that a page shows an AI notice, and the name that marks a decision, such as a function called approve.
Complipath keeps only those fields. Anything else in a request is dropped when it arrives.

What happens to the result

It is read like a code connection's: AI systems it finds appear as suggestions that a person adds to the register or ignores.
Live's code rules read the same result. A finding from code stays marked Possible, and one the next scan no longer finds is marked fixed.

What it does not do

It reads code only. It does not read logs.
It has no schedule of its own. It runs when your CI runs it.
It skips files over 200 KB and stops at 20,000 files. A result over 512 KB is not sent; the scanner asks you to scan one project at a time.
Your CI must reach Complipath twice: to download the scanner and to post the result. Only the code stays inside.

Which plan

Growth, which is not for sale yet: open today to pilot workspaces. On Starter the connection pages are locked, and Complipath refuses a result from a workspace whose plan does not include connections.

Where it sits in the law

It is not an EU AI Act duty. It is another way to give Complipath the same code reads that a GitHub or GitLab connection makes.

Those reads feed Live, whose checks name Article 50(1) and Articles 14 and 26 of Regulation (EU) 2024/1689, and point (c) of Article 5(1) of the GDPR.

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

Does the scanner send our source code?

No. It sends the repository name, the commit id and, per file with a match, the path, the line, the vendor and a short name: a library, host, model id, key variable, personal-data field or decision name. Never a value or a line of text. Anything else is dropped on arrival.

How do we know the scanner file is the right one?

The app shows the file's SHA-256. The template downloads the file and checks it against that value with sha256sum before it runs, and the scanner checks its own checksum again when it starts. A file that does not match stops the job before anything is read.

What does our CI need?

Node 18 or newer and a way to reach Complipath: it downloads one file and posts the result to your webhook address, signed with your secret. The address and the secret go in as masked CI variables. Nothing is installed from npm, and a request signed too far from the current time is refused.

Which plan includes it?

Growth, which is not for sale yet; today it is open to pilot workspaces. Starter, at €499 a month for up to 20 AI systems, shows the connection pages locked, without the scanner. Prices exclude VAT. A result from a workspace without connections in its plan is refused.