One page, every repository you own

A connection is a host, a credential and a scope. Twelve kinds of host are supported, and an estate that grew by acquisition usually needs three or four of them at once. Each connection carries its own labels for what the systems behind it hold, which is what later lets the same finding be a medium in one place and a critical in another.

From there it asks the host what repositories that credential can see, and clones them. Every branch, and the whole commit history behind them, because a credential deleted last March is still in the history and that is where most of them are.

Which branches is the connection's own decision, because an account holding a handful of release repositories and an account that has collected thousands of abandoned feature branches want different answers. A history too large to walk inside one run is walked across several, newest first, carrying on from where the last run stopped until it reaches the first commit, and using the hours nobody else wants to get there.

Three of them look for credentials, and they disagree with each other, which is the point. Three read the code. Three read the dependency tree and what it is built on. One reads the pipeline. They run against a working tree that exists only for the length of the scan.

Where a machine has enough shared memory, the whole thing runs in memory and never touches a disk, because the cleartext of every credential found passes through those files on its way to becoming a hash and a mask. Where it does not, the scan says so in the log rather than doing it quietly.

Raw output from ten engines across a real estate is tens of thousands of findings and most of them are noise. Everything between that and the screen is the part that matters: entropy and pattern rules that separate a credential from an example, a fidelity pass that reads code findings back in context, a reachability verdict on every dependency, and a ranking that puts a credential the provider just confirmed still works above a critical nobody can reach.

Every one of those judgements shows its reasoning as a sentence, so a person can disagree with the argument rather than just the answer, and every rule behind them is editable from a page in the product.

A finding exists because somebody published an advisory. A component exists because it is in the tree. So the bill of materials a scan builds is kept: every package, every version, every license, and every repository and branch it sits on, searchable by name or by package URL. That is the only kind of table that can answer "is this exact version anywhere in our code" on the morning a release is announced as compromised, two days before there is an advisory to match on.

A finding that somebody set aside is not deleted. It carries who decided, why, and when the decision lapses, it still appears in the report files marked as excluded, and the decision is in an audit log that can be searched. That record is the difference between a scanner and something an auditor will accept.

The same applies to a run that did not finish. A repository stopped at its time limit keeps the passes that did complete and is reported as partial rather than as scanned or failed, because it is neither and a reader needs to know which half they are holding. An account nobody has put anything in yet is recorded as empty, not as a failure, so a red row on that page still means something the night it appears.

It does not write to your repositories, open pull requests, revoke keys or change anybody's settings. Every credential it holds is read only by design, and the product refuses to ask for more. Nothing about your code is sent anywhere: no cloud service, no telemetry, no license check. The only outbound traffic is to public vulnerability databases, and to a credential's own issuer when live verification is switched on, which is one flag away from off.