scanning-vulns

Static vulnerability scanning analyzes arbitrary codebases read-only to surface credible vulnerabilities without executing code. It generates VULN-FINDINGS.json and a human-readable Markdown summary to enable safe triage and focused remediation planning.

Codebase vulnerability scanning produces VULN-FINDINGS.json for automated triaging and a human-readable Markdown summary for quick review. An optional scoring pass provides additional confidence evaluation for the suspected issues.

Yes, static analysis can review arbitrary dependency trees to surface candidate vulnerabilities for triage. The scanner reads source files read-only and provides clear guidance on suspected issues and confidence levels without executing the code.

Static vulnerability scanning requires no special execution environment because it operates entirely read-only. It safely analyzes arbitrary repositories by reading source files and enforcing non-execution to prevent any code from running.

The best way to triage static code review findings is to use the generated VULN-FINDINGS.json output. This structured file is specifically designed to be consumable by triaging workflows for focused remediation planning.

Limitations of read-only vulnerability scans include the inability to detect runtime or dynamic issues since code is never executed. It surfaces candidate vulnerabilities statically, requiring further triage to confirm exploitability.