security-review

Automated security scanning detects Python, Node, or Java project profiles to tailor the scan suite, coordinating dependency checks and DAST scans. It orchestrates scanners across multiple repositories to aggregate findings and enforce a deterministic risk gate for CI-CD pipelines.

Gating CI-CD pipelines using normalized vulnerability findings requires aggregating scanner outputs into a deterministic risk gate. This process normalizes dependency-check and DAST results, producing a gate JSON artifact that decides whether the security review passes or fails.

Generating a security gate decision alongside human-friendly reports produces an aggregate JSON, a gate JSON, and a Markdown report. This normalizes vulnerability findings from multiple scanners into unified output artifacts for both automated pipelines and human review.

This security review tool supports OpenSpec integration, coordinating profile detection, scanner planning, and report rendering across multiple repositories. It detects repository signals and orchestrates scans to satisfy OpenSpec artifact requirements.

Profile detection is required before running DAST scans and dependency checks to identify Python, Node, or Java environments. Detecting these project signals tailors the scan suite, ensuring the appropriate security scanners are planned and executed for accurate vulnerability normalization.