Reference
Scanner checks
The scanner runs four deterministic checks. A check is a plain function over the files in a folder, so the same input always gives the same findings. This page lists exactly what each check looks for.
| Check | Looks for | Severities |
|---|---|---|
secrets | Credentials committed to source | critical |
deps | Known-vulnerable pinned dependencies | medium to critical |
iac | Risky infrastructure and container configuration | medium, high |
zero_click | Code and payload patterns that lead to remote code execution | high, critical |
#What gets scanned
The scanner walks the folder and skips .git, node_modules, .venv, venv, __pycache__, target, dist and build. It skips any file larger than 512 KB. Findings are sorted by severity, highest first.
#secrets
Looks for these patterns, line by line, in every scanned file.
| Pattern | Reported as |
|---|---|
AKIA followed by 16 uppercase letters or digits | AWS access key |
ghp_ followed by 36 letters or digits | GitHub personal access token |
sk- followed by 20 or more letters or digits | OpenAI or Stripe-style secret key |
-----BEGIN PRIVATE KEY-----, with optional RSA or EC | Private key |
password, passwd, api_key, api-key or secret assigned a quoted string of 8 or more characters | Hardcoded credential |
Every match is critical. A line is skipped when it contains example, changeme, your_, xxxxx, dummy, placeholder or redacted, in any case, so documentation and templates do not trigger findings.
#deps
Reads pinned versions in requirements*.txt, constraints*.txt, Gemfile.lock, pom.xml and package.json. A line is parsed when it has the form name==version. It compares the version to the advisories below.
| Package | Affected | Advisory | Severity |
|---|---|---|---|
lodash | below 4.17.21 | CVE-2021-23337, command injection via template | high |
requests | below 2.31.0 | CVE-2023-32681, Proxy-Authorization header leak | medium |
openssl | below 3.0.0 | CVE-2022-0778, infinite loop in BN_mod_sqrt | high |
log4j-core | below 2.17.1 | CVE-2021-44832, RCE via JDBC appender | critical |
#iac
Reads .tf, .yaml, .yml and .json files for these rules.
| Pattern | Message | Severity |
|---|---|---|
0.0.0.0/0 | Network rule open to the world | medium |
publicly_accessible = true | Database publicly accessible | high |
An IAM statement with "Effect": "Allow" and "Action": "*" on one line | IAM policy allows Action * | high |
In any file whose name starts with Dockerfile, it also reports the following.
| Pattern | Message | Severity |
|---|---|---|
:latest | Unpinned :latest image tag | medium |
USER root | Container runs as root | medium |
#zero_click
Looks for sinks that attackers reach without any user action.
| Pattern | Message | Severity |
|---|---|---|
pickle.loads, yaml.unsafe_load, marshal.loads, ObjectInputStream | Unsafe deserialization sink | critical |
${jndi:ldap://, and the rmi, dns and iiop forms | JNDI remote lookup sink | critical |
subprocess.Popen, run, call or check_output with shell=True on one line | Shell command execution sink | high |
#Choosing checks
The built-in codebase-guardian agent enables all four checks. To run a subset on part of a repository, add a repository agent. See Configuration.
#What the scanner does not do
- It does not follow data flow, so it cannot tell whether a sink is reachable.
- It does not read inside binary files or files over 512 KB.
- It reports patterns line by line, so a pattern split across lines is missed.
For these, use the agents. The Zero-Click Rapid Defender confirms from the source whether a sink is reachable. See Security agents.