How the AI Pipeline Works

Claude performs deep static analysis, looking for SQL injection, XSS, command injection, path traversal, insecure deserialization, hardcoded secrets, broken auth, SSRF, and 15+ other vulnerability classes. 22 regex pre-scan patterns are run first to score file risk and prioritise the order of analysis.

Every CRITICAL and HIGH finding is re-verified against the full file context. This step asks: 'Is this actually exploitable given the surrounding code?' Findings that don't hold up are dropped before the next step.

A second, lighter AI pass runs on all remaining findings (including MEDIUM and LOW) to catch any remaining false positives. Only findings that survive both passes are shown to you.

Each confirmed finding is matched against the NVD (National Vulnerability Database) for CVE IDs and CVSS scores, EPSS for exploit probability percentile, and the CISA Known Exploited Vulnerabilities catalog. A CISA KEV match means the vulnerability is being actively exploited in the wild.

Results are compiled into structured JSON (full detail), SARIF 2.1.0 (for GitHub Security tab), and GitHub Issues Markdown. Remediation status (open/fixed/accepted/wontfix) is tracked per finding.