Winfunc Infrastructure Scanner

Spec sheet

What it does

Winfunc scans infrastructure-as-code, cloud configurations and container definitions for misconfigurations, exposed secrets and compliance violations before production.Read 21 Oct 2026 · winfunc.com

Purpose

Scans infrastructure-as-code, cloud configurations, and container definitions for misconfigurations, exposed secrets, and compliance violations before production.Read 7 Oct 2026 · winfunc.com

Intended users

The product page describes continuous cloud posture assessment and policy enforcement, while pricing offers Enterprise terms for regulated teams.Read 7 Oct 2026 · winfunc.com

Deployment

The Trust Center describes self-hosted deployment on premises or in a private cloud, with data remaining within the customer’s perimeter.Read 7 Oct 2026 · winfunc.com

Integrations

The platform lists GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Actions, Jenkins, CircleCI, Jira, Slack and Microsoft Teams integrations.Read 21 Oct 2026 · winfunc.com

Security

The Trust Center says Winfunc is SOC 2 Type II certified and ISO 27001 is in progress.Read 7 Oct 2026 · winfunc.com

Support

The Trust Center says Enterprise includes a dedicated security engineer, priority Slack channel, response times under one hour for critical issues, and quarterly security reviews.Read 7 Oct 2026 · winfunc.com

Access model

The web security console is invite-only and requires signing in with an invited GitHub account.Read 21 Oct 2026 · app.winfunc.com

API and keys

Enterprise documentation says API and MCP keys are stored as SHA-256 hashes and can be revoked.Read 21 Oct 2026 · winfunc.com

Cloud analysis

Reviews cloud IAM policies, detects network exposure and storage misconfigurations, and checks for drift between declared infrastructure and actual cloud state.Read 7 Oct 2026 · winfunc.com

Cloud integrations

Cloud-provider API connections provide real-time posture assessment for AWS, GCP and Azure.Read 21 Oct 2026 · winfunc.com

Cloud posture

Continuous cloud assessment compares environments with CIS benchmarks and detects drift from declared infrastructure.Read 21 Oct 2026 · winfunc.com

Cloud providers

Maps CIS Benchmark compliance for AWS, GCP, and Azure and uses cloud provider APIs for real-time posture assessment.Read 7 Oct 2026 · winfunc.com

Code retention

The Trust Center says source code is processed in memory and discarded after analysis, retaining only finding metadata.Read 7 Oct 2026 · winfunc.com

Company backing

The maker says it is backed by Y Combinator's Summer 2024 batch.Read 21 Oct 2026 · winfunc.com

Company founding

Stition, Inc. was incorporated in Delaware in 2024.Read 21 Oct 2026 · winfunc.com

Compliance frameworks

Maps findings to CIS, SOC 2, ISO 27001, PCI DSS, and HIPAA and offers audit-ready reports with evidence and remediation guidance.Read 7 Oct 2026 · winfunc.com

Compliance mapping

Findings can be mapped to CIS, SOC 2, ISO 27001, PCI DSS and HIPAA with evidence-based reports.Read 21 Oct 2026 · winfunc.com

Container scanning

Dockerfiles and Docker images are checked for CVEs, permission problems and insecure base images.Read 21 Oct 2026 · winfunc.com

Containers

Scans Dockerfiles and container images for known CVEs, misconfigured permissions, and insecure base images, with CI pre-deploy gates.Read 7 Oct 2026 · winfunc.com

Data retention

The security terms state that source code is analyzed in ephemeral workspaces and deleted after each scan while findings are retained.Read 21 Oct 2026 · winfunc.com

Documentation depth

Product pages link to documentation, but no public API or SDK reference with endpoint details is presented on the reviewed pages.Read 21 Oct 2026 · winfunc.com

Hypothesis scans

A hypothesis scan turns a bounded security question into a repository-scoped investigation with traces, supporting evidence, conclusions and limitations.Read 21 Oct 2026 · winfunc.com

IaC support

The infrastructure scanner supports Terraform, CloudFormation and Pulumi templates.Read 21 Oct 2026 · winfunc.com

IAM review

Cloud IAM analysis identifies overly permissive roles and unused credentials.Read 21 Oct 2026 · winfunc.com

Independent company profile

Y Combinator describes Winfunc as an active San Francisco SaaS, B2B security and AI company.Read 21 Oct 2026 · ycombinator.com

Independent employee fact

LinkedIn names Vivek R and Mufeed VH among the employees shown for winfunc.Read 21 Oct 2026 · linkedin.com

Independent founders fact

Y Combinator lists Mufeed VH as founder/CEO and Vivek R as founder/CTO.Read 21 Oct 2026 · ycombinator.com

Independent news

LinkedIn reports that Winfunc-associated research found two NGINX CVEs while scans cost under $100 and generated $4,500 in Chrome VRP bounties.Read 21 Oct 2026 · linkedin.com

Independent size fact

LinkedIn lists winfunc as privately held with 2–10 employees.Read 21 Oct 2026 · linkedin.com

Kubernetes analysis

It analyzes Kubernetes manifests and enforces security policies.Read 21 Oct 2026 · winfunc.com

Limit: availability

The maker's own roadmap leaves general availability undated.Read 21 Oct 2026 · winfunc.com

Limit: evidence scope

Hypothesis scans are bounded by the authorized repository, server-owned branch, submitted question and available evidence; absence of a finding does not prove a claim true or false.Read 21 Oct 2026 · winfunc.com

Limit: one-time scope

The one-time scan excludes reusable credits, MCP, suggested patch pull requests, AI triage and ongoing incremental, scheduled or pull-request review.Read 21 Oct 2026 · winfunc.com

Limit: pricing transparency

Pay-as-you-go credits, recurring allowances and Enterprise pricing are not shown as dollar amounts and require discussion or an agreement.Read 21 Oct 2026 · winfunc.com

Maker legal name

The company page identifies the maker as Stition, Inc.Read 21 Oct 2026 · winfunc.com

MCP and editors

Winfunc MCP brings snippet, codebase and change-review scanning into Cursor, Claude Desktop, Windsurf and Cline.Read 21 Oct 2026 · winfunc.com

Model training

Winfunc says customer code and data are not used to train AI models.Read 21 Oct 2026 · winfunc.com

Network exposure

Network analysis highlights public resources, open security groups, missing transit encryption and policy-violating paths.Read 21 Oct 2026 · winfunc.com

Notable research

Winfunc's research page records 48 public disclosures, 22 CVE IDs and 25 projects.Read 21 Oct 2026 · winfunc.com

Release status

The maker's roadmap lists an alpha in November 2025, beta in March 2026 and general availability as not yet dated.Read 21 Oct 2026 · winfunc.com

Remediation

The product prioritizes findings by severity and business context and can generate infrastructure-as-code patches.Read 21 Oct 2026 · winfunc.com

Secrets detection

The scanner looks for API keys, tokens, passwords and certificates in IaC, configuration and environment definitions.Read 21 Oct 2026 · winfunc.com

Security assurance

Winfunc states that it is SOC 2 Type II audited.Read 21 Oct 2026 · winfunc.com

Self-hosting

Customer-controlled hosting inside a customer cloud or private environment is an Enterprise option.Read 21 Oct 2026 · winfunc.com

Supported formats

Supports Terraform, CloudFormation, Pulumi, Kubernetes manifests, and Dockerfiles.Read 7 Oct 2026 · winfunc.com

System requirements

No client operating-system or hardware requirements are stated on the reviewed infrastructure, pricing or product pages.Read 21 Oct 2026 · winfunc.com

Transport and credentials

The vendor states that connections use TLS and onboarding test credentials use per-record XChaCha20-Poly1305 encryption.Read 21 Oct 2026 · winfunc.com

Plans and prices

Every Winfunc Infrastructure Scanner plan and price →

Where Specifiction places it

• Infrastructure as Code Security Software#16 of 227.8