Security analyzers

Alongside the AI review, eight analyzers scan the same diff. They're deterministic — no model involved — so their findings are stable and explainable.

Analyzer	What it finds
sast	Static analysis via Semgrep plus a CWE-tagged rule fallback.
secrets	Hardcoded keys, tokens and credentials.
dependency	Known-vulnerable packages via the OSV database.
iac	Unsafe Terraform / Kubernetes definitions.
cloud_misconfig	Risky AWS / GCP / Azure configuration.
complexity	Functions grown past safe maintenance.
duplication	Copy-paste logic being introduced.
dead_code	Unreachable code paths.

What counts as "security"

The Security dashboard, the Findings security filter and the security CSV export all agree on one definition: security, secret, sast, iac and cloud. Dependency findings are deliberately not counted as security — they have their own category and filter so vulnerable-package noise never inflates your security posture.

Severity

Findings carry a real severity — critical, high, medium, low or info — derived per finding rather than stamped uniformly.

Exports

A CycloneDX SBOM and a findings CSV are available whenever you need evidence for an audit.