Coverage
One product. Every surface. No separate bill.
14 languages, 19 configuration formats and six review surfaces. Code, dependencies, inventories, cryptography, secrets and configuration are one product and one plan, not modules sold apart.
- 14
- Languages
- 19
- Configuration formats
- 6
- Review surfaces
- 1
- Plan, everything included
What gets examined
Six surfaces, one run.
A release decision needs all of these together. Splitting them across products is a licensing choice, not a technical one.
SAST
Source-code review
Injection, traversal, unsafe deserialization, weak cryptography, dynamic code execution and the rest of the classes that matter, mapped to CWE.
SCA
Dependency review
Direct and transitive components matched offline against an advisory database that ships with the scan, so a dependency check tells no one which libraries you depend on.
SBOM
Software inventory
CycloneDX 1.5 and SPDX 2.3 exports that state their own scope, so a source inventory is never mistaken for a built-artifact one.
CBOM
Cryptographic inventory
Every algorithm in use, sound ones included, classified by kind and by whether a quantum computer would break it outright. An inventory that lists only the broken algorithms cannot answer a migration question.
Credentials
Secrets review
Credentials and sensitive values in code and configuration. A finding carries a redacted preview and a hash, never the value itself, so the secret stays on your machine.
IaC
Configuration review
Infrastructure, container and pipeline configuration, where a single permissive setting undoes the code review above it.
Built today
What the engine does now.
Coverage is easy to claim and hard to check, so these are counts from the repository rather than estimates. Each rule has a vulnerable fixture it must find and a safe fixture it must leave alone, and none of them ship until both pass.
- 649
- Detection rules, each with two fixtures
- 135
- Distinct CWEs covered by those rules
- 286k
- Advisories in the offline database, across 10 ecosystems
- 28
- Credential detectors, entropy filtered
Exports
Results move into the tools you already use. Nothing here is a premium format.
SARIF 2.1.0
Findings, with the data-flow path and the coverage the scan achieved.
CycloneDX 1.5
Software inventory, stating the scope it was built from.
SPDX 2.3
Software inventory in the second standard format.
CycloneDX VEX
One entry per advisory, listing every component it affects.
CycloneDX 1.6 CBOM
Cryptographic inventory, with quantum-vulnerable algorithms marked.
JSON
The complete result, for anything the formats above do not carry.
Depth of analysis
Three levels, stated per language.
Most tools say a language is supported without saying what that means. We state the depth, because the difference decides which findings you get.
L1
Inventory and dependencies
Every component you depend on, matched against known vulnerabilities, with software and cryptographic inventories you can export.
Lockfiles and manifests are parsed, components identified by package URL, and advisories matched offline against a database that ships with the scan. This is the layer that answers what is in the build and which known issues apply to it.
L2
Direct code analysis
Unsafe API use, weak cryptography, disabled protections, hardcoded credentials and insecure configuration, found in the code itself.
Rules run over the parsed syntax of each file. Findings name the exact call and line, and each rule states what it cannot determine.
L3
Data-flow analysis
Injection and traversal flaws traced from the point untrusted input enters to the point it reaches a dangerous operation.
The analysis follows a value within a function and at module level, recognising the sanitizers that make a path safe. Findings carry the path itself, so a reviewer can check the reasoning rather than trust a score. Flow between functions is not followed yet, and every rule of this kind says so in its stated limits.
Languages
14 with data-flow analysis, 14 in total.
Every language here is part of the same product and the same plan. Coverage for your stack is confirmed in writing during scoping.
| Language | Depth | Rules | Frameworks and focus |
|---|---|---|---|
| Python | L3 | 82 | Django, Flask, FastAPI, SQLAlchemy |
| Java | L3 | 69 | Spring, Jakarta, JDBC, Jackson, Maven, JSP and Thymeleaf |
| JavaScript | L3 | 46 | Node, Express, GraphQL, EJS, Handlebars and Nunjucks |
| Go | L3 | 37 | Standard library, database/sql, os/exec, net/http |
| PHP | L3 | 34 | Laravel, Symfony, PDO, WordPress, Twig and Blade |
| C# | L3 | 26 | ASP.NET Core, Entity Framework, appsettings and web.config |
| TypeScript | L3 | 26 | Node, Next.js, NestJS, Angular and Vue |
| C | L3 | 19 | Memory safety, integer conversion, format strings, signals |
| C++ | L3 | 19 | Memory safety, casts, exceptions, iterator invalidation |
| Kotlin | L3 | 17 | Spring, Ktor, Android |
| Ruby | L3 | 18 | Rails, ActiveRecord, ERB |
| Swift | L3 | 13 | Application and device code |
| Rust | L3 | 12 | Unsafe blocks, axum, sqlx, Command, Askama |
| Scala | L3 | 11 | Play, Slick, Doobie, Twirl, Akka |
Configuration formats
A permissive setting here undoes the code review above it, so configuration is reviewed in the same run rather than sold as a separate cloud product.
| Format | Depth | Rules | Focus |
|---|---|---|---|
| Terraform | L2 | 23 | AWS, Azure, GCP and OCI resources |
| Kubernetes | L2 | 11 | Pod security context, namespaces, RBAC and limits |
| Dockerfile | L2 | 13 | Base image, package pinning, user and trust store |
| GitHub Actions | L2 | 12 | Workflow triggers, action pinning, script injection |
| Dependency manifests | L1 | 11 | Lockfile integrity, pinning and declared licences |
| Ansible | L2 | 12 | Shell tasks, file modes, checksums and secrets |
| nginx | L2 | 11 | TLS policy, headers and upstream request framing |
| HTTP headers | L2 | 11 | Baseline headers, content security policy and values |
| Android manifest | L2 | 10 | Exported components, backup and cleartext traffic |
| CI pipelines | L2 | 10 | Unpinned images and secrets in pipeline files |
| CloudFormation | L2 | 14 | Public storage and permissive policies |
| OpenAPI | L2 | 10 | Deprecation policy and per-operation security |
| Pulumi | L2 | 10 | Stack secrets and public resource properties |
| SQL | L2 | 10 | Migrations, procedures, definers and grants |
| SSH configuration | L2 | 12 | Host key size and post-quantum key exchange |
| Crossplane | L2 | 10 | Connection secrets and managed resource settings |
| HTML | L2 | 10 | Subresource integrity on third-party scripts |
| iOS property list | L2 | 10 | App transport security exceptions |
| Jenkins | L2 | 10 | Pipeline steps interpolating branch and change data |
One plan
Everything is included.
No per-language pricing, no separate SAST, dependency, secrets or infrastructure products, no charge per scan and no premium export format. One agreement covers the product as it grows.
As the product grows, existing customers receive the additions under the same agreement.
Discuss an evaluationA useful next conversation
Find the right product for your review workflow.
Tell us what you need to examine, where your work runs, and what evidence your team needs.