fleet-scanning-vulns

To run a static security audit without executing code, point the scanner at your target directory to analyze the source tree and vendored libraries read-only. It outputs a structured VULN-FINDINGS.json and a Markdown report for triaging findings.

Yes, you can guide vulnerability review using a threat model by providing a THREAT_MODEL.md file in the target directory. The scanner reads it to define specific focus areas and fans out one review agent per area.

The best way to automate vulnerability review for large arbitrary codebases is using a scalable fan-out approach. This scanner deploys multiple review agents across defined focus areas to statically identify vulnerabilities and output structured findings.

Static code analysis works with vendored libraries by treating them as part of the arbitrary target codebase. The scanner performs read-only analysis on the entire source tree to surface potential vulnerabilities without executing any code.

The formats output for triaging static analysis findings are a structured VULN-FINDINGS.json file and a companion human-readable Markdown report. These outputs are designed to be ingestible by triaging processes.

A limitation of static vulnerability review is that it operates statically without executing code, meaning it cannot identify runtime vulnerabilities or dynamic execution flaws. It relies on reading source trees and optional threat models to surface candidate findings.