Corgea

What is Corgea?

Corgea is an application security platform that uses AI to find vulnerabilities and write fixes for developers to review. Its AI SAST scans source code and looks for business logic flaws such as broken authentication, missing auth checks and authorization gaps that rule-based scanners tend to miss. The same account covers dependency scanning, secrets detection, container scanning, infrastructure-as-code scanning, code quality and license enforcement. Findings are traced from public routes such as /login to the code and packages that attackers could reach, so teams can fix the riskiest issues first. Fixes arrive as pull request comments, in IDEs including Visual Studio Code, Cursor and IntelliJ, or through an MCP server on paid tiers. Corgea connects to GitHub, GitLab, Azure DevOps, Bitbucket and Harness, and the company states SOC 2 Type II compliance. The Free plan costs $0 for two people and 10 repositories, Growth is $39 per developer per month, Scale is $49, and Enterprise is custom.

Use cases

• Scan code for security vulnerabilities
• Find broken authentication and access control flaws
• Auto-fix findings in pull requests
• Detect exposed secrets before merge
• Scan containers and Terraform for misconfigurations
• Enforce open-source license rules

Who it's for

• Developers
• Security engineers
• DevOps teams
• CISOs

Why use Corgea

• The Free plan covers AI SAST, secrets, dependency, container and IaC scanning with no credit card.
• Fixes appear as reviewable pull request changes, so developers stay in their normal workflow.
• Reachability tracing from public routes helps teams work on issues attackers can actually reach.
• One platform replaces separate scanners for code, packages, containers and infrastructure.
• Seats count only developers who contributed in the last 90 days.

Corgea features

• AI SAST with business logic and authentication flaw detection
• Dependency scanning with upgrade suggestions
• Secrets detection
• Container scanning
• Infrastructure-as-code misconfiguration scanning
• Pull request scanning with auto-fix comments
• Corgea Agent and IDE extensions
• Custom and blocking rules on Scale
• JIRA and Slack integrations, plus API and webhooks
• SSO, SCIM, audit logs and single-tenant deployment on Enterprise

Corgea integrations

• GitHub
• GitLab
• Azure DevOps
• Bitbucket
• Harness
• Visual Studio Code
• Cursor
• Visual Studio 2022
• IntelliJ
• JIRA
• Slack

How to get started with Corgea

1. Create a Free account, no credit card needed, and connect a repository from your source host.
2. Corgea scans the code, dependencies, secrets, containers and infrastructure files.
3. Findings are prioritized by whether they can be reached from exposed routes.
4. Review suggested fixes in a pull request or your IDE and merge the ones you accept.
5. Upgrade to Growth or Scale for PR scanning, custom rules, reporting and higher auto-fix limits.

Corgea limitations

• Free is limited to 2 team members, 10 repositories and 10 PR scans per month
• Free includes 10 SAST auto fixes, Growth 50 and Scale 200
• Growth requires at least 5 developers and Scale at least 20
• PR scanning, code quality, the Corgea Agent and JIRA integration need a paid plan

Corgea pricing

Yes, Corgea has a free plan. Paid plans start at $39 per month, according to the official pricing page on 24 Oct 2026.

Corgea plans

• Free

  $0

  • AI SAST
  • Logic and auth scanning
  • Dependency and secrets scanning
  • Container and IaC scanning
  • 2 team members, 10 repos

• Growth

  $39 /dev per month

  • PR scanning
  • Code quality
  • Corgea Agent
  • JIRA integration
  • License enforcement

• Scale

  $49 /dev per month

  • Custom rules
  • Blocking rules
  • Reporting and analytics
  • Team management
  • APIs and webhooks

• Enterprise

  Custom

  • SSO and SCIM
  • Single-tenant
  • SLA management
  • Audit logs
  • Premium support

Plans as listed on the official pricing page on 24 Oct 2026. Prices can change and may vary by country or exclude tax. Check the official pricing page.

Corgea alternatives

The main Corgea alternatives listed on Debuly are Semgrep, Checkmarx, DeepSource, Codacy, Nullify and Sourcery. The table compares pricing and platforms; order is A–Z.

1. 

   Checkmarx

   Application security platform that scans code, open-source packages, APIs and containers, with AI agents for triage and fixes.

   CodingDeveloper platformsAutomation and agents
   Contact salesVisit Checkmarx (official site)
2. 

   Codacy

   Automated code quality and security scanning with an AI reviewer for pull requests and free real-time guardrails in the IDE.

   CodingDeveloper platforms
   FreemiumVisit Codacy (official site)
3. 

   DeepSource

   AI code review platform that pairs static analysis with AI review and Autofix on every pull request, with a 14-day free trial.

   CodingDeveloper platforms
   Free trialVisit DeepSource (official site)
4. 

   Nullify

   Autonomous product security platform that finds vulnerabilities, proves exploitability and opens merge-ready fix pull requests.

   CodingAutomation and agentsDeveloper platforms
   Contact salesVisit Nullify (official site)
5. 

   Semgrep

   Application security platform for static analysis, supply chain and secrets scanning, with AI-assisted triage and fixes for developers and coding agents.

   Developer platformsCoding
   FreemiumVisit Semgrep (official site)
6. 

   Sourcery

   AI code review for GitHub and GitLab pull requests with summaries, suggested fixes and security scanning, free on public repositories.

   CodingDeveloper platformsAutomation and agents
   FreemiumVisit Sourcery (official site)

Corgea FAQ

Sources & verification

Facts on this page come from the official sources below, each with the date we read it. Written by Debuly; the vendor did not review this page.

Image credits

• Logo: from corgea.com · fetched 23 Oct 2026 · Vendor trademark, used only to identify the product; removed on request
• Cover: none collected yet, so a generated tile is shown.

Spot an error? Report an issue with this listing. We also remove a logo or image on the owner's request.