# GateTest

> GateTest is an AI-powered code quality and security gate. It scans a codebase with 122 modules — covering security, supply chain, accessibility, reliability, and code quality — then, on its paid tiers, opens a pull request that fixes what it found. It runs as a GitHub Action, a local pre-push hook, or an on-demand scan — priced per scan, with optional Continuous and MCP subscriptions.

## Key facts

- Name: GateTest (https://gatetest.io)
- What it is: a unified code-quality and application-security gate (SAST + SCA + a DAST slice) with 122 modules
- Languages: JavaScript, TypeScript, Python, Go, Java, Ruby, PHP, plus infrastructure-as-code (Docker, Terraform, Kubernetes, CI workflows)
- Output formats: Console, JSON, HTML, SARIF (for GitHub code scanning), JUnit
- AI fix loop: each finding is fixed by the AI fix engine, validated through a syntax + re-scan gate, and shipped with a generated regression test in a reviewable pull request
- Pricing: Quick Scan $29, Full Scan $99, Scan + Fix $199, Forensic $399 (one-time, per scan) · Continuous $49/mo · MCP $29/mo
- Replaces or complements: SonarQube, Snyk, ESLint, GitHub code scanning, DeepSource, Semgrep, CodeQL

## Start here

- [Homepage](https://gatetest.io/): what GateTest is and how the gate works
- [How it works](https://gatetest.io/how-it-works): the scan-and-fix pipeline
- [Modules](https://gatetest.io/modules): all 122 checks, each with its own page
- [Trust & security](https://gatetest.io/trust): how customer code is handled

## Glossary (definitions)

- [Static Application Security Testing (SAST)](https://gatetest.io/glossary/sast): SAST analyses source code, bytecode, or binaries for security flaws without running the program — catching vulnerabilities like injection, hardcoded secrets, and unsafe deserialization before code is executed or deployed.
- [Dynamic Application Security Testing (DAST)](https://gatetest.io/glossary/dast): DAST tests a running application from the outside — sending real requests to find vulnerabilities that only appear at runtime, like broken authentication, missing security headers, and server misconfiguration.
- [Software Composition Analysis (SCA)](https://gatetest.io/glossary/sca): SCA inventories the third-party and open-source dependencies in a project and flags known vulnerabilities, license risks, and unmaintained packages — the supply-chain layer that your own code never touches directly.
- [Static Analysis Results Interchange Format (SARIF)](https://gatetest.io/glossary/sarif): SARIF is an OASIS-standard JSON format for static-analysis results. It lets any scanner report findings — with file, line, rule id, and severity — in a structure that IDEs, CI systems, and GitHub code scanning all understand.
- [Quality Gate](https://gatetest.io/glossary/quality-gate): A quality gate is an automated pass/fail checkpoint in a pipeline that blocks code from merging or deploying unless it meets defined thresholds — zero new criticals, no leaked secrets, tests passing — making quality a precondition rather than a hope.
- [Mutation Testing](https://gatetest.io/glossary/mutation-testing): Mutation testing measures how good your tests actually are by introducing small bugs (mutants) into the code and checking whether the test suite catches them. A test suite that passes despite the injected bug has a real gap.
- [False Positive Rate](https://gatetest.io/glossary/false-positive-rate): The false positive rate is the share of a scanner's findings that aren't real problems. It's the single biggest factor in whether a security tool gets used or ignored — high noise trains developers to dismiss everything, including the true positives.
- [Software Supply Chain Security](https://gatetest.io/glossary/supply-chain-security): Supply-chain security protects everything your software depends on but doesn't write — open-source packages, build tools, CI pipelines, and base images — from compromise, because an attacker who poisons a dependency or a build step compromises every downstream user at once.
- [Software Bill of Materials (SBOM)](https://gatetest.io/glossary/sbom): An SBOM is a machine-readable inventory of every component in a piece of software — each dependency, its version, and its license. It's what lets you answer 'are we affected?' in minutes when the next critical CVE drops.
- [Secret Scanning](https://gatetest.io/glossary/secret-scanning): Secret scanning detects credentials — API keys, tokens, private keys, passwords — accidentally committed to source code, so they can be revoked before an attacker finds them. Once a secret hits git history, it's compromised until rotated.
- [Shift Left](https://gatetest.io/glossary/shift-left): Shift left means moving testing and security earlier in the development lifecycle — into the editor, the commit, and the pull request — instead of waiting for a pre-release audit, because a bug caught at authoring time costs a fraction of one caught in production.
- [Technical Debt](https://gatetest.io/glossary/technical-debt): Technical debt is the implied future cost of choosing a fast or easy solution now instead of a better one that would take longer. Like financial debt, it accrues interest — every shortcut makes future changes slower until it's paid down.

## Use cases

- [Block pull requests on security findings](https://gatetest.io/use-cases/block-pull-requests-on-security-findings): Run GateTest as a required status check on every pull request so any error-severity finding — a leaked secret, an injection, a vulnerable dependency — fails the check and blocks the merge until it's fixed.
- [Add a quality gate to CI/CD](https://gatetest.io/use-cases/ci-cd-quality-gate): A CI/CD quality gate runs your standards — security, supply chain, tests, complexity — as an automated pass/fail step on every build, so quality is enforced consistently instead of depending on who's reviewing.
- [Auto-fix vulnerabilities with an AI pull request](https://gatetest.io/use-cases/auto-fix-vulnerabilities): On the Scan + Fix tier, GateTest doesn't stop at finding issues — the fix engine writes the fix, validates it through a syntax and re-scan gate, generates a regression test, and opens a pull request you review and merge.
- [Scan a monorepo](https://gatetest.io/use-cases/monorepo-scanning): GateTest scans a whole monorepo in one pass — every package, multiple languages, shared and per-package config — without standing up a separate pipeline per project, and reports findings with their real file paths.
- [Catch issues before they're pushed](https://gatetest.io/use-cases/pre-push-gate): Install GateTest as a git pre-push hook so secrets, syntax errors, and obvious vulnerabilities are surfaced on your machine, at the moment you push — the last point where a leaked credential can still be pulled before anyone else clones it.
- [Show findings in GitHub code scanning](https://gatetest.io/use-cases/sarif-github-code-scanning): GateTest emits SARIF, the standard format GitHub code scanning ingests, so every finding appears as an inline annotation on the pull-request diff — tracked across commits and dismissible — instead of buried in CI logs.
- [Gate on vulnerable and risky dependencies](https://gatetest.io/use-cases/dependency-supply-chain-gate): GateTest inventories your dependencies across ten ecosystems and fails the gate on wildcard or unpinned versions, missing lockfiles and deprecated packages — and, for npm projects, on reachable critical/high advisories from npm audit — the supply-chain layer your own code never touches.

## Blog

- [Why AI-Generated Code Needs a QA Gate](https://gatetest.io/blog/why-ai-generated-code-needs-a-qa-gate): AI writes code faster than any human can review it. That speed is real leverage — and it quietly changes where bugs come from and how fast they accumulate. Here's why an automated gate stops being optional once an agent is committing to your repo.
- [SAST vs DAST vs SCA: What Each Catches (and Misses)](https://gatetest.io/blog/sast-vs-dast-vs-sca): Three acronyms cover most of application security scanning, and they are not interchangeable. Each sees a different slice of your risk — and has a blind spot the others cover. Here's a practical breakdown of when to use which.
- [Cutting Static-Analysis False Positives Without Missing Real Bugs](https://gatetest.io/blog/cutting-false-positives-in-static-analysis): The false-positive rate is the single biggest reason security scanners get switched off. But naively suppressing findings hides real bugs too. Here are the techniques that lower noise without lowering coverage.

## Comparisons

- [GateTest vs sonarqube](https://gatetest.io/compare/sonarqube)
- [GateTest vs snyk](https://gatetest.io/compare/snyk)
- [GateTest vs eslint](https://gatetest.io/compare/eslint)
- [GateTest vs github-code-scanning](https://gatetest.io/compare/github-code-scanning)
- [GateTest vs deepsource](https://gatetest.io/compare/deepsource)
- [GateTest vs semgrep](https://gatetest.io/compare/semgrep)
- [GateTest vs codeql](https://gatetest.io/compare/codeql)

## Vulnerability & compliance references

- [CWE Top 25 — detection & fixes](https://gatetest.io/find): 25 pages mapping each weakness to GateTest coverage
- [Compliance regimes](https://gatetest.io/regulation): 5 pages (GDPR, HIPAA, PCI DSS, and more) framed for what GateTest checks

## Optional

- [Pricing](https://gatetest.io/#pricing)
- [Install the GitHub App](https://gatetest.io/github/setup)
- [Sitemap](https://gatetest.io/sitemap.xml)