What R2Devops does

R2Devops is a privately held French software company, founded in 2022 and based in Montpellier, that builds and operates Plumber (also branded "getplumber"), a CI/CD security platform. The company is led by co-founders Aurélien Coget (CEO) and Thomas Boni (CPO) and operates with a 1–10 person team. Its commercial product targets DevOps and security teams whose software delivery pipelines run on GitHub Actions or GitLab CI/CD, including regulated European enterprises that must evidence pipeline security under ISO 27001, NIS2, DORA, SOC 2, or the EU Cyber Resilience Act (CRA).

Plumber's technology is structured as a four-step continuous loop: Map every pipeline across an organization's repositories, Detect security weaknesses (exposed secrets, mutable or untrusted container images, unpinned third-party actions, dangerous triggers, missing branch protection), Fix via a deterministic AI agent that opens merge requests with rule-checked changes, and Prove via the proprietary Plumber Score, an A-to-E letter grade that aggregates dozens of checks. The stack comprises an open-source CLI (free, distributed via Homebrew, mise, Docker, and a prebuilt binary, and runnable as a GitHub Action or GitLab CI component), a cloud Platform that adds org-wide dashboards, drift alerts, history, and compliance reporting, and Plumber Radar, a public initiative that continuously scans public GitLab and GitHub projects to publish ecosystem-wide CI/CD security grades.

R2Devops runs a product-led, freemium go-to-market model. The CLI and the Platform's free tier (up to 10 projects, 7-day history, community support) drive developer adoption and top-of-funnel growth. Revenue comes exclusively from a custom-priced Enterprise tier covering 10+ projects with AI fixes, unlimited history, portfolios, and dedicated support, sold via direct contact. The company is bootstrapped (no disclosed funding rounds), serves a global self-serve customer base through its open-source and marketplace distribution, and operates without any disclosed subsidiaries, acquisitions, or investors.

Name

R2Devops

Legal name

Plumber

Website

https://r2devops.io

Company type

Private

Founded year

2022

Operating status

Operating

Headcount range

11–50 employees

Short description

R2Devops operates Plumber, a CI/CD security platform that maps pipelines, detects vulnerabilities, applies AI-driven fixes, and grades security posture A–E for organizations using GitHub Actions and GitLab CI/CD.

Ownership category

akta.pro rank

Product category

DevSecOps / CI/CD Security

NAICS

Custom Computer Programming Services (541511), Computer Systems Design and Related Services (5415), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (518)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Computer Programming Services (7371)

akta.pro primary industry

Observability, Monitoring & AIOps (BPAEAKAG)

akta.pro secondary industries

Data Security & Privacy Managed Services (DLP/Encryption) (BPAEADAL), Security Operations Center (SOC) as a Service (BPAEADAB)

Keywords

• CI/CD security scanning
• DevSecOps automation
• Pipeline compliance scoring
• Software supply chain security
• Secrets detection

Headquarters

HQ city

Montpellier

HQ country

France

HQ region

Europe

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Open Source CLI: Free open-source command-line tool for scanning individual pipelines. Available via Homebrew, mise, Docker, or prebuilt binary. Generates community adoption and drives top-of-funnel for paid tiers.
2. Platform Free Tier: Free tier of the Plumber Platform supporting up to 10 projects with core CI/CD controls, 7-day history, scheduled scans, and community support. Provides organizational dashboards and org-wide visibility.
3. Enterprise Platform: Custom-priced enterprise tier for 10+ to unlimited projects. Includes AI fixes and suggestions, unlimited history, portfolios, and dedicated support. Tiered pricing based on project count and feature requirements.

Pricing tiers

Go-to-market motion2 records

Distribution channels5 records

Marketing channels7 records

Core offering

R2Devops operates Plumber, a CI/CD security platform that automatically maps every pipeline across an organization's repositories, detects security leaks (exposed secrets, untrusted registries, mutable images, unpinned actions, dangerous triggers), and remediates them through a deterministic AI agent that opens merge requests. The platform produces an audit-ready Plumber Score (A to E) and compliance evidence for ISO 27001, NIS2, DORA, SOC 2, and the EU Cyber Resilience Act, with a free open-source CLI for individual pipeline scanning and a paid Enterprise tier for unlimited organizational monitoring.

Product overview

Plumber by R2Devops is a unified CI/CD security platform consisting of an open-source CLI (free, for scanning individual pipelines from the terminal or CI), a cloud Platform (with free tier for up to 10 projects and paid Enterprise tier for unlimited scaling), and a Plumber Score grading system. The Platform builds on the CLI by adding organization-wide monitoring, drift detection, AI-agent remediation, and compliance reporting. A complementary public initiative called Plumber Radar tracks CI/CD security across the open-source ecosystem.

Differentiator

Problem solved

Functional benefit

Products and services

• Plumber Open Source CLI

Quantifiable outcome

• Scans any pipeline in minutes with zero setup and no agents required
• +1 more outcomes

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration2 records

AI capability4 records

Feature7 records

Partnerships

Two partnerships are on record, tiered core.

• GitLabcoreTechnology or IntegrationNative integration with GitLab CI/CD. Plumber is available as a GitLab CI component for pipeline integration. The product works with both GitLab's dark and light themes.
• GitHubcoreTechnology or IntegrationNative integration with GitHub Actions. Plumber is available as a GitHub Action for workflow integration. The product works with both GitHub's black and white themes.

Scale indicators5 records

Recent moves6 records

Expansion highlights4 records

Direct peers

• Spectral: Spectral scans code, secrets, and Infrastructure-as-Code configurations, with strong native integrations into GitHub and GitLab. It is a directly comparable pipeline-and-code scanning tool, particularly on secret and config misconfiguration detection.
• Apiiro: Apiiro maps code-to-runtime risk across the SDLC with a focus on software supply chain and pipeline security posture. It targets the same DevSecOps buyer and competes for budget allocated to pipeline-governance initiatives.
• Cycode: Cycode is a software supply chain security platform purpose-built around CI/CD pipelines and SDLC risk. It directly overlaps Plumber's pipeline-mapping, secret-detection, and drift-detection capabilities and pursues a similar enterprise SaaS motion.
• GitGuardian: GitGuardian focuses on secrets detection across code repositories, CI logs, and developer environments. It is the most cited dedicated competitor to Plumber's secret-detection and unmasked-variable controls within pipelines.
• Snyk: Snyk is a developer-first security platform that scans code, open-source dependencies, containers, and IaC. Like Plumber it embeds into the developer workflow and sells a SaaS subscription upgrade, and it is now extending coverage into CI/CD pipeline posture, the core R2Devops use case.

Broad incumbents

• Aqua Security: Aqua Security covers the full cloud-native security stack including container and pipeline scanning. Its Trivy family of open-source scanners overlaps with Plumber's CLI-first posture and is a credible adjacent alternative.
• Sonar (SonarQube): Sonar provides code-quality and code-security analysis with deep CI/CD integration. It is a broad incumbent in developer-facing security scanning and an indirect competitor for the same DevOps budget owner.
• Checkmarx: Checkmarx is an established application-security platform covering SAST, SCA, and IaC scanning. It competes for the same CISO budget but historically focused upstream of the pipeline rather than on pipeline-config posture.
• GitLab Secure: GitLab Secure is GitLab's integrated SAST, DAST, dependency, and container security suite. Like GitHub Advanced Security it bundles pipeline-adjacent security directly inside the platform R2Devops integrates with.
• GitHub Advanced Security: GitHub Advanced Security is GitHub's native code-scanning and secret-scanning suite, bundled for enterprises. It is the most natural incumbent alternative for any organisation already on GitHub Actions and the most likely source of platform-level competitive pressure on Plumber.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

• Xx.com/r2devops_io
• GitHubgithub.com/getplumber
• LinkedInlinkedin.com/company/r2devops
• Facebookfacebook.com/profile.php

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about R2Devops