--- title: "Only 4 of 28 DevOps tools scan code, dependencies and secrets together" summary: "What TechBag's count of 28 developer-tool products showed on pipeline scanning, GitHub's per-committer price in rupees, and India's ₹25.5 crore average breach, as of September 2026." url: https://www.thetechbag.com/blog/security-enterprise-devops-strategies-best-practices-keeping format: Note desk: "Security operations" published: 2025-06-17 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["DevSecOps","secrets scanning","SAST","dependency scanning","GitHub Advanced Security","SonarQube","JFrog","IBM Cost of a Data Breach","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/security-enterprise-devops-strategies-best-practices-keeping.png --- # Only 4 of 28 DevOps tools scan code, dependencies and secrets together *What TechBag's count of 28 developer-tool products showed on pipeline scanning, GitHub's per-committer price in rupees, and India's ₹25.5 crore average breach, as of September 2026.* Note · Security operations · By TechBag · Published 2025-06-17 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/security-enterprise-devops-strategies-best-practices-keeping Four of the 28 developer-tool products in TechBag’s guide scan all three things a pipeline should check before code ships: the code itself, the open-source dependencies it pulls in, and the secrets committed alongside it. Thirteen scan something; fifteen scan nothing.[1] The 2023 version of this post said to “implement security early” and quoted a global breach cost from a 2020 survey. The Indian average is now ₹25.5 crore [3], and the practical question is which tool in the toolchain does the early checking. ## What the toolchain actually scans The four with all three scanners are GitHub Enterprise with its security add-ons, the GitLab DevSecOps Platform on the Ultimate tier, JFrog Advanced Security and SonarQube Advanced Security. Dependency scanning is the most common single capability, in nine products; secrets scanning is in eight, and static analysis of the code in six.[1] **Figure: Only 4 of 28 DevOps toolchain products scan code, dependencies and secrets together** *Developer-tool SKUs by pipeline scanning capability, count, TechBag guide reviewed 24 August 2026* No scanning 15 SKUs Dependencies 9 SKUs Secrets 8 SKUs Code (static analysis) 6 SKUs All three together 4 SKUs | | Value (SKUs) | | --- | --- | | No scanning | 15 | | Dependencies | 9 | | Secrets | 8 | | Code (static analysis) | 6 | | All three together | 4 | Source: TechBag developer tools guide, 28 SKUs across 9 vendors; TechBag count · as of 30 September 2026 · A product can appear in several bars; most of the 15 with no scanning are API, infrastructure or AI tools Three of the four are add-ons, which is where the original’s “automate security testing” meets a price. GitHub split Advanced Security into two products from 1 April 2025: Secret Protection at US$19 and Code Security at US$30 per active committer a month, sold on the Team plan as well as Enterprise.[2] JFrog Advanced Security needs Xray, which needs Enterprise X, and is quoted; SonarQube Advanced Security is an extra subscription on Server or Cloud Enterprise, also quoted.[1] ## Why the Indian numbers point at the pipeline IBM’s 2026 study for India, released on 3 August 2026, put the average breach at ₹25.5 crore, up 15.9% on ₹22 crore a year earlier. Supply-chain compromise was the third most common way in, at 15%, behind phishing at 19% and drive-by compromise at 16%. Breaches at organisations that used security AI and automation extensively cost ₹21.3 crore against ₹31.6 crore for those that did not.[3] TechBag countTechBag arithmetic: 40 committers on GitHub Both GitHub add-ons for 40 active committers: 40 × US$49 × 12 = US$23,520 a year, about ₹19,52,160 at ₹83 to the dollar, or ₹23,03,549 with 18% GST. Secret Protection alone is ₹7,56,960 before GST.[2] Our view Our view: buy in the order an attacker works. Secrets first, because a leaked key is usable the moment it is public and push protection stops it at the commit; dependencies next, because that is the supply-chain door IBM counts; static analysis last. Education and monitoring, the original’s other two practices, still matter, but they do not stop a key from reaching a public repository. **In India.** These tools are priced at US list; buy through a reseller in INR with 18% GST, or pay the foreign invoice with IGST under reverse charge. Residency is the trap: SonarQube Cloud stores data in the EU or the US only, so code that must stay in India means SonarQube Server, self-hosted.[1] CERT-In’s Directions of 28 April 2022 require incidents to be reported within six hours and logs kept for 180 days within India.[4] SEBI’s cyber resilience framework has applied to regulated entities since 31 August 2025.[5] The DPDP Rules, notified on 13 November 2025, bring security-safeguard duties into force on 13 May 2027, and the Act sets a penalty of up to ₹250 crore for failing to keep reasonable safeguards.[6] [7] How we did this Figures as of 30 September 2026 Scanning capability is TechBag’s count from the developer tools guide as it stood on 30 September 2026 (28 SKUs across nine vendors, reviewed 24 August 2026), using the guide’s own tags for static analysis, dependency and secrets scanning; IaC and container scanning were not counted. GitHub prices are from GitHub’s changelog. Indian breach figures are IBM’s, reported for a sample of breached organisations. INR uses ₹83 to the dollar and adds 18% GST. The 2023 original’s 60% unpatched-breach figure was dropped because its source could not be confirmed. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, Developer tools guide (scanning tags, add-on terms, SonarQube Cloud data regions)](https://www.thetechbag.com/browse/devops/developer-tools) — reviewed 24 August 2026 2. [GitHub changelog, Introducing GitHub Secret Protection and GitHub Code Security](https://github.blog/changelog/2025-03-04-introducing-github-secret-protection-and-github-code-security/) — 4 March 2025 3. [IBM India newsroom, India records its highest average cost of a data breach (₹25.5 crore; vectors; AI and automation)](https://in.newsroom.ibm.com/India-Records-its-Highest-Average-Cost-of-a-Data-Breach-2026) — 3 August 2026 4. [CERT-In, Directions under section 70B(6) of the IT Act, 2000](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 5. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024; in force 31 August 2025 6. [Legismith Partners, DPDP Rules 2025 commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — Rules notified 13 November 2025 7. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 Related on TechBag: the [developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools) carries the 28 products counted here; the [HashiCorp Vault page](https://www.thetechbag.com/hashicorp/hashicorp-vault) covers the secrets store that keeps keys out of the repository. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Developer tools guide](https://www.thetechbag.com/browse/devops/developer-tools) — the scanning tags behind the 4 of 28 count - [HashiCorp Vault](https://www.thetechbag.com/hashicorp/hashicorp-vault) — the secrets store that keeps keys out of the repository