Frequently Asked Questions

Is my code stored anywhere?

No. Files uploaded to the web tool are processed in memory and never written to disk or stored. The scan runs in an isolated serverless function and the data is discarded when the response is sent.

How accurate is the scanner?

The 5-step pipeline (scan → investigate → revalidate) is designed to eliminate false positives before results reach you. In practice, false positive rates are significantly lower than traditional SAST tools. That said, no scanner is perfect — always review findings in context.

What is CISA KEV?

The CISA Known Exploited Vulnerabilities catalog is a list of CVEs that the US Cybersecurity and Infrastructure Security Agency has confirmed are being actively exploited in real attacks. A CISA KEV match is the highest-priority signal for patching.

What is EPSS?

The Exploit Prediction Scoring System (EPSS) is a probability score (0–100%) of how likely a CVE is to be exploited in the next 30 days, based on threat intelligence data. A high EPSS score means the vulnerability is actively targeted.

Can I scan private / sensitive code?

Yes — traffic is encrypted over HTTPS and code is not stored. For highly sensitive codebases, use the CLI tool locally so code never leaves your machine. The CLI calls the Anthropic API directly from your environment.

Why do some files get skipped?

Files matching common ignore patterns (node_modules, .git, lock files, binaries, images) are automatically excluded. Very large files (> ~500KB) may also be skipped to stay within API limits.

How do I get an Anthropic API key for the CLI?

Sign up at console.anthropic.com, create a project, and generate an API key. New accounts receive free credits to get started.

Still have questions?