Forma turns code review, compliance checks, and client reporting into a single repeatable workflow. Built for founders who bill on outcomes, not hours.
Runs 200+ deterministic checks across your codebase in under 90 seconds. No fluff scoring, just exact line references your clients can verify.
Git-native. Forma compares every commit against your chosen standard—SOC 2, OWASP, or custom rulesets—and surfaces only what changed.
One command generates a signed, timestamped PDF scoped to exactly what your contract covers. No redacting. No post-processing.
Push results to Slack, Linear, Jira, or any endpoint. Every event is idempotent and replay-safe. Your integrations stay intact on reruns.
import { defineConfig } from 'forma' export default defineConfig({ // run every push to main trigger: 'push:main', audit: { standard: 'owasp-top10', custom: './rules/billing.ts', failOn: 'critical', }, report: { format: 'pdf', sign: true, recipient: 'client@acme.com', }, webhooks: [ { url: process.env.SLACK_HOOK, events: ['audit.pass', 'audit.fail'], }, ], })
Not a JIRA plugin. Not a compliance theater SaaS. Forma is for practitioners who own their client relationships end-to-end.
| Audience | What Forma does for you |
|---|---|
|
Freelance devs
Solo engineers & contractors
|
Gives you audit artifacts your clients can hold—so disputes about scope become non-conversations. Close the engagement, move on. |
|
Agencies
Digital product studios
|
Standardize quality across all client projects without doubling QA headcount. One config file, consistent output on every delivery. |
|
Founders
Technical startup founders
|
Ship investor updates and due-diligence packages that include verifiable code quality signals—not just a Loom and a roadmap slide. |
|
Auditors
Security & compliance consultants
|
Run reproducible assessments with full trace logs. Every finding links to a commit hash. No more "it depends on the environment" calls. |
Each feature ships with a test harness, an escape hatch, and documentation your clients can actually read.
Every check in Forma's audit engine is a pure function: same input, same output, every time. No machine-learning scoring, no confidence intervals—just pass, fail, or skip with a reason code.
$ forma audit --standard owasp-top10 ✓ Scanning 312 files... ✓ Running 214 checks in 4 workers CRITICAL 0 findings HIGH 2 findings MEDIUM 7 findings → HIGH src/auth/session.ts:88 CWE-384 Session fixation — token not rotated on login → HIGH src/api/upload.ts:142 CWE-434 Unrestricted file upload — MIME not validated Report saved: ./forma-report-2025-01-14.pdf Signed: SHA256:3fa2c...b91
Forma generates scoped, signed PDFs formatted for non-technical stakeholders without removing the technical receipts your team needs. One report, both audiences.
export const report = { formats: ['pdf', 'html', 'json'], branding: { logo: './assets/logo.svg', primary: '#0d0f12', accent: '#00c9b1', }, sections: { executiveSummary: true, findingsDetail: true, remediation: true, appendix: 'technical-trace', }, sign: { enabled: true, keyPath: './keys/forma.key', }, }
Forma ships a GitHub Action, a GitLab CI template, and a bare CLI binary. No Docker-in-Docker, no privileged runners, no 45-minute setup guides.
name: Forma Audit on: [push, pull_request] jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: forma-dev/action@v1 with: token: ${{ secrets.FORMA_TOKEN }} standard: owasp-top10 fail-on: critical report: true
Every audit is an API-first event. Trigger runs, pull results, stream findings in real time. All webhooks are idempotent, signed with HMAC-SHA256, and include replay headers.
import { Forma } from '@forma/sdk' const forma = new Forma({ token: process.env.FORMA_TOKEN, }) const run = await forma.audits.create({ repo: 'acme/backend', ref: 'main', standard: 'owasp-top10', }) // Stream findings in real time for await (const finding of run.stream()) { console.log(finding.severity, finding.cwe) }
Every tier includes the core audit engine. Upgrade when your client count, team size, or compliance requirements grow—not before.
No contracts. Cancel any time. Downgrade, not delete.
Your next client won't take your word for it. Give them a signed report they can actually read.