ScannerInvestigate

See the system you actually built.

Scanner reasons across code, configuration, dependencies, and architecture to find the compound risks and system-specific failures that rules alone cannot name.

The dangerous behavior is rarely contained in one file.

Modern systems fail across boundaries: identity in one layer, authorization in another, data flow somewhere else, and infrastructure assumptions outside the repository entirely.

A suspicious pattern is a starting point. Scanner follows the surrounding paths and controls to determine whether the candidate holds up.

Code and configurationThe implementation and the environment it assumes
Trust and control pathsWhere identity, authority, and data cross boundaries
Evidence and consequenceWhat is demonstrable and why it matters

A closed finding, not a suspicious pattern.

Scanner builds a system model, traces candidate attack paths, and tests each hypothesis against repository evidence. Candidates are validated, rejected, or left explicitly unresolved.

Run Scanner in your own coding-agent session against a local repository. Get a readable report and supporting evidence covering root cause, affected boundaries, practical consequences, and remediation—with coverage and uncertainty visible.

Example calibration / authorization ownershipPinned target · candidate closure

Illustrative example. Shows the intended workflow, not a final product screen or a recorded run. Counts and outcomes are illustrative.

Validated attack path

Authenticated requestexport route accepts invoice identifier
Object identity acceptedjob payload omits tenant binding
Privileged worker readservice client bypasses row policy
Cross-tenant disclosureattacker-selected invoice rendered

Closed finding

Alternate export path bypasses tenant ownership.

High · confidence high
  • SourceAuthenticated user controls the invoice identifier on the export route.
  • Missing controlThe queued job carries object identity but not the authenticated organization.
  • SinkThe worker reads with a service credential outside row-policy enforcement.
  • ConsequenceA user can request an invoice belonging to another organization.

Disposition: validated. Root cause, reachability, boundary failure, and consequence are supported by repository evidence.

Vulnerable revision

Finding validatedIllustrates recognition of a cross-file failure.

Safe lookalike

Candidate rejectedIllustrates how counterevidence rules out a candidate.

Clean revision

Coverage supports conclusionIllustrates why a clean conclusion needs coverage.

Follow the evidence until every candidate has a disposition.

Scanner treats coverage, evidence, and closure as part of the security judgment. Completion is not a tool run or a pile of plausible findings.

  1. 01Bind the target

    Pin the repository state, scope, exclusions, and security properties the review must preserve.

  2. 02Model the system

    Map identities, assets, trust boundaries, control points, entry paths, and material dependencies.

  3. 03Trace candidates

    Follow plausible failures from source to consequence across files, layers, and controls.

  4. 04Close the set

    Validate, reject, or bound every candidate and reconcile the result against achieved coverage.

Before releaseUnderstand what the system became.
During changeReview the consequences of a material diff.
In inherited codeBuild a security model before trusting it.

Three products. One security model carried forward.

01 / ShapeArchitect

Shape security-sensitive decisions while building.

 02 / InvestigateScanner

Investigate system-level risk across the codebase.

 03 / WatchSentry

Watch deployed posture as the system changes.

Inspect the system, not the file.

Investigate the system as a whole, with evidence that can survive scrutiny.