source-code-scanning

Security-focused static analysis uncovers vulnerabilities, hardcoded secrets, and malicious code by orchestrating SAST tools like Semgrep, secrets detectors like TruffleHog, and dependency CVE scanners to produce structured findings and an executive summary report.

Checking dependencies for known CVEs across different package ecosystems uses ecosystem-native audits like pip-audit, npm audit, and govulncheck, with Trivy or Grype as fallback to identify vulnerable third-party package versions.

Detecting malicious code and supply-chain tampering in open-source repositories involves flagging suspicious patterns that indicate backdoors or supply-chain tampering, combining secrets detection with manual review mapping to CWE Top 25 during incident or bounty recon.

Static analysis supports multi-language projects for security scanning by detecting common security weaknesses using tools like Semgrep, Bandit, gosec, Brakeman, and CodeQL across various programming languages within the same repository.

Security findings during a local repository audit are mapped to severity using CVSS scores and the CWE Top 25 list, producing structured findings and evidence artifacts that help prioritize remediation of detected vulnerabilities.