Build flows that react to findings the moment they appear: open a fix, raise a ticket, wait for an approval or rotate a leaked secret. Your team designs the rules and keeps control of every step.
Illustrative flow · synthetic data
Steps on the left, the flow on the canvas, configuration on the right. A dry run shows exactly which path a finding takes before anything goes live.
Each flow is a set of steps your team defines once. Plexicus runs it for every finding that matches and records what happened.
Start a flow when a finding is created, enriched or reopened. You can also run it by hand, on a schedule or from a signed webhook.
Route by severity, finding type or repository with if and switch conditions. Every step has a success path and an error path.
Draft a fix, open a ticket, notify the team, call an external API or rotate a leaked secret with the integrations you already use.
Add approval gates, set timeouts and review each run. Editing a flow creates a new version, so runs in progress keep the rules they started with.
Whichever way you start, the flow is validated before it is saved, and nothing runs until an admin activates it.
High and critical findings go straight to automated remediation with a reviewer-ready change. Everything else becomes a triage ticket. If a fix cannot be prepared, a ticket is opened instead.
New finding → severity check → remediation or Jira ticket
Generate a new value, store it in HashiCorp Vault, open a draft PR that replaces the hardcoded secret with an environment variable, verify the new value, then promote the PR after approval. Any failure opens a ticket.
Rotate → store in Vault → draft PR → verify → approve → promote PR
Every integration must pass a connection test before a flow that uses it can be activated.
Flows run inside the same controls as the rest of Plexicus.
Only admins can create, edit or activate flows. Everyone else can read the run history. Every change is audited.
Wait for an approver before sensitive steps. A step that waits too long follows its error path, and a run that exceeds its maximum duration is stopped.
Integration secrets are encrypted at rest and write-only: they are never shown again after saving. Outbound HTTP calls are protected against internal network access.
Each finding runs a flow once and runs it again only when it is reopened. Duplicate triggers do not create duplicate work.
Test a flow before activating it, then replay any run step by step with the input and output of each step.
Every flow, integration and run belongs to one workspace. Nothing crosses between customers.
Book a walkthrough to see a finding trigger a flow, pause for approval and hand over a reviewer-ready change.
