railguard-vulncategory-scan

Run a single-pass security vulnerability scan by executing a four-category sweep covering injection, network/CORS, access control, and logic vulnerabilities. This monolithic workflow analyzes architecture and data flows in one pass to produce a consolidated security posture report.

Yes, you can scan multiple programming languages in one workflow. The scanner supports Python, JavaScript/TypeScript, Java, Go, Ruby, and PHP projects, analyzing authentication, authorization, CORS, and logic vulnerabilities simultaneously.

Semgrep is not required but is supported as an optional scanning tool. The core vulnerability category sweeps rely on an LLM environment with repository access and ripgrep-based tools, loading rules from references to analyze data flows.

The best way to triage security findings in a large repository is using a single-agent workflow that performs architecture-aware gating and phase-based data-flow tracing. This unifies findings across domains into one consolidated report for quick assessment.

Architecture-aware gating works during a security sweep by tracing phase-based data flows to unify vulnerability findings across different domains. It analyzes how data moves through the system to accurately identify injection, access control, and logic vulnerabilities.

A limitation of using an LLM agent for static security analysis is the requirement for an LLM environment with direct access to repository files. While it supports optional Semgrep scanning, complex data flows may require careful interpretation of the consolidated findings.