What the scan looks for
A fixed set of well-known open-source scanners, each at a fixed version, so the same code always gives the same result. No AI is involved in this step.
- Passwords, keys and tokens in the code, and in the history of your default branch: including what was removed long ago
- Dependencies with a known vulnerability, and packages known to be malicious, from your lockfiles
- Risky patterns in Python, JavaScript and TypeScript, such as SQL built from loose text or input that ends up in a shell command
- Dockerfiles and the configuration of Kubernetes, Helm and Terraform
- Runtimes and frameworks that no longer get security updates
What you get back
For every finding: what it is, where it is, how serious it is and what you can do about it. You see it in your workspace in layers: the traffic light for the board, what it means for product and operations, and for developers the file and the line.
A secret we find is never shown and never sent to an AI model. We advise you to replace it, even when it only remains in the history.
What the scan doesn't do
The scan only reads. It doesn't run your code, doesn't touch your servers or your database, and changes nothing in your repository. We don't attack or penetration-test your running site: this is a look into the code you can repeat on every new version.
Why on every new version
With AI, new code arrives faster, and so does a new dependency or a forgotten key. That's why the scan belongs with every new version of your code, not with an audit once a year. With continuous checks it runs again as soon as there is new code.