# Sightline

> Sightline scans your code, dependencies, infrastructure and live URLs in one place, ranks every finding by its attack path to customer data, and drafts the fix. Built for SaaS and fintech teams without a security department.

Sightline is a product made by Thinkiyo (https://thinkiyo.com/). Sightline is available now; a Thinkiyo team sets it up with each customer. Like every Thinkiyo product, Sightline runs in the customer's own cloud or self-hosted, and customer data stays in the customer's own database. A person approves anything that goes out to a customer. Contact: hello@thinkiyo.com.

## What it is
Find the risk that reaches your data. Fix that first. Code, dependencies, infrastructure and live URLs in one place, ranked by attack path, each with a drafted fix.

Application and cloud security for fast-growing SaaS and fintech teams: static analysis, secrets, dependency and supply chain checks, infrastructure-as-code and Dockerfile scanning, outside-in testing of live URLs, one asset graph with attack paths ranked by distance to sensitive data, AI triage with drafted fixes approved by a person, and SOC 2, ISO 27001, OWASP ASVS and PCI DSS control mapping.

## Who it is for
Fast-growing SaaS and fintech startups without a dedicated security team

## Key capabilities
- Code: Every repo, every lockfile.
- Cloud: Infrastructure before it deploys.
- Live surface: What the internet can reach.
- Scan code, secrets and packages: Static analysis, secret detection and dependency checks run in one pass, with extra rules for access control, injection and SSRF.
- Catch cloud misconfiguration before deploy: Terraform, CloudFormation, Kubernetes and Dockerfiles are checked against two policy sets, and overlapping results merge into one.
- Test what is live, from the outside: Sightline probes your deployed URLs with no credentials, the way an attacker would, and fingerprints the stack it finds.
- Cut the noise before it reaches you: Duplicates merge, known-safe findings drop out with the reason kept, and each finding is checked against your real architecture.
- Get the fix, not just the finding: Each finding comes with a plain-English explanation, a CVSS score and a drafted fix. Nothing is applied without approval.
- Map findings to the controls auditors ask about: Open findings roll up into control checks for SOC 2, ISO 27001, OWASP ASVS and PCI DSS, ready to hand to a reviewer.
- Know the day an advisory hits your stack: New advisories are matched to each repo's bill of materials, and scans run again on a schedule you set.

## Pages
- [Sightline](https://thinkiyo.com/sightline/): Code and cloud security for SaaS and fintech
- [Full text for language models](https://thinkiyo.com/sightline/llms-full.txt): every section, the FAQ and every blog post as plain text
- [Blog](https://thinkiyo.com/sightline/blog/): Notes on cloud and app security for SaaS and fintech teams.

## Blog
- [How Sightline works: attack paths for SaaS and fintech startups](https://thinkiyo.com/sightline/blog/how-sightline-works/): A walkthrough of Sightline: one asset graph, agentless open-source scanning, findings ranked by blast radius, AppSec review and SOC 2 evidence.
- [How to answer a customer security questionnaire without a security team](https://thinkiyo.com/sightline/blog/how-to-answer-a-customer-security-questionnaire-without-a-security-team/): A practical guide for SaaS and fintech startups facing their first big-customer security review, from asset inventory to evidence.
- [Sightline: find the path, not the pile](https://thinkiyo.com/sightline/blog/find-the-path-not-the-pile/): Security tools flag everything. Sightline maps how your cloud, identities and data connect, and shows the one path that matters.

## Optional
- [RSS feed](https://thinkiyo.com/sightline/blog/rss.xml)
- [Privacy](https://thinkiyo.com/sightline/privacy/)
- [Terms](https://thinkiyo.com/sightline/terms/)
- [Thinkiyo](https://thinkiyo.com/llms.txt): the company and every other Thinkiyo product