Security Scans

Secrets, injection, auth gaps and vulnerable dependencies caught in review, each one explained as an exploit story rather than a rule ID.

Leaked API keys and credentials are flagged on the lines that introduce them, as part of normal code review, no separate gate at the end of the cycle.
SQL built from raw input, unsanitized user data and similar risks are surfaced with the exact file and line, tagged by severity.
Missing authentication or authorization on routes is detected and checked against the ticket's security requirements, not just generic patterns.
Lockfiles and manifests for npm, Yarn and pnpm, PyPI, Maven, Gradle and sbt, Go, Cargo, NuGet, RubyGems, Composer, Swift, Dart and Elixir are checked against OSV and GitHub advisories on every PR, across the whole repository, not just the diff.
Every dependency across your repositories in one inventory (license risk, known vulnerabilities, zero-days and malicious packages), plus the blast radius: which repositories a compromised package reaches. Export as CycloneDX 1.6, SPDX 2.3, CSV or PDF.
Apex, Visualforce and Lightning components are scanned on every PR, and metadata changes to permission sets, sharing rules, guest-user access, Flows and Agentforce are flagged when they loosen access. /security-scan --deep-apex adds data-flow analysis through Apex on request.
Every finding explains the concrete abuse scenario in plain language, together with a suggested fix diff you can apply in one click.

acme/payments-service⌘K

#59 · acme/payments-serviceFETCHED

SECRETS 2 · 2 CRITDEPS 0LICENSE 0

SECRETS 2SAST 0DEPS 0

LEAKED CREDENTIALS (0)

Stripe live secret key committed in environment config.

CRITICAL

Rotate the key, then move it to your secret manager and reference it at runtime.

src/config/env.ts:14

Postgres password hardcoded in docker-compose.

CRITICAL

Use an env_file entry and keep credentials out of version control.

docker-compose.yml:22

More Features