How Akasa Air put one security standard across a million lines of aviation code
Since adding CodeAnt AI to our GitHub workflow, reviews have become faster and more focused. We're spotting issues early and shipping better code with less back-and-forth
Adil Khanday
Software Architect, Akasa Air($350M Valuation)
Akasa Air's engineering division powers the digital systems behind flight operations, crew management, pricing, and customer experience, all built on distributed GitHub repositories.
CHALLENGE
Five teams, five sets of tools, one million lines of mission-critical code.
Akasa's GitHub ecosystem grew faster than the coverage over it. Scanning was fragmented and inconsistent between teams, which meant vulnerabilities, secrets, and misconfigurations were being caught late in the cycle rather than at the point they were introduced. Leadership had no single view of security posture, so the question "where are we exposed" could only be answered by asking around.
All of that sat under aviation-grade compliance pressure, against a codebase that kept growing with no automated risk detection behind it.
The result was blind spots, manual checks, and slower delivery. Three things that usually arrive together.
WHY CODEANT
The team needed the checks to get stricter and the workflow to stay the same.
That combination is the hard part. Any tool can add a gate. Adding one that engineers route around, or that turns every pull request into a negotiation, buys compliance on paper and loses it in practice.
Akasa wanted AI-driven reviews, automated security checks, and faster feedback loops, without disrupting how the teams already worked. Native to GitHub, not a separate dashboard someone remembers to open.
WHAT WE RAN
CodeAnt became the always-on Code Health layer inside GitHub, across every service:
SAST. Insecure patterns, SQL risks, unsafe APIs, and missing validations.
IaC security. Kubernetes, Docker, and YAML misconfigurations, including privilege escalation paths, missing limits, root user, and weak security rules.
SCA. Critical and high CVEs across Python, Node, and Java, each with a fix suggestion attached.
Secrets detection. Hard-coded secrets, AWS keys, and credentials, caught immediately.
Code quality. Dead code, duplicates, anti-patterns, and missing documentation.
Risk funnels. A clear view for leadership of where security and quality risk is concentrated across services.
WHAT CHANGED
