sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 62 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

docs: align tool inventory with what actually runs (no Grype, no ZAP/nuclei)
CI / Check (push) Skipped
CI / Check (pull_request) Failing after 3m1s
Details
CI / Detect Changes (pull_request) Skipped
Details
CI / Deploy Agent (pull_request) Skipped
Details
CI / Deploy Dashboard (pull_request) Skipped
Details
CI / Deploy Docs (pull_request) Skipped
Details
CI / Deploy MCP (pull_request) Skipped
Details

Browse Source 
CVE matching is done directly against OSV.dev (by purl) and NVD (CVSS, CODESYS
CPE) in pipeline/cve.rs; Grype is not installed or invoked. DAST/pentest use the
in-house compliance-dast agents, not ZAP or nuclei. Found while reconciling the
Certifai requirements spec (Collectives) with the code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv
This commit is contained in:
Sharang Parnerkar
2026-08-31 15:05:06 +02:00
co-authored by Claude Fable 5
parent 0834547a74
commit b7b9c812ab
6 changed files with 14 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guide/scanning.md
+2 -2
View File
@@ -8,7 +8,7 @@ When a scan is triggered, Certifai runs through these phases in order:
1. **Clone** -- pulls the latest code from the Git remote (or clones it for the first time)
2. **SAST** -- runs static analysis using Semgrep with rules covering OWASP, GDPR, OAuth, secrets, and general security patterns
3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via Grype
3. **SBOM** -- extracts all dependencies using Syft, identifying packages, versions, licenses, and known vulnerabilities via OSV.dev + NVD
4. **CVE Check** -- cross-references dependencies against the NVD database for known CVEs
5. **Graph Build** -- parses the codebase to construct a code knowledge graph of functions, classes, and their relationships
6. **AI Triage** -- new findings are reviewed by an LLM that assesses severity, considers blast radius using the code graph, and generates remediation guidance
@@ -52,7 +52,7 @@ A full scan runs multiple analysis engines, each producing different types of fi
| Scan Type | What It Detects | Scanner |
|-----------|----------------|---------|
| **SAST** | Code-level vulnerabilities (injection, XSS, insecure crypto, etc.) | Semgrep |
| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + Grype |
| **SBOM** | Dependency inventory, outdated packages, known vulnerabilities | Syft + OSV.dev/NVD |
| **CVE** | Known CVEs in dependencies cross-referenced against NVD | NVD API |
| **GDPR** | Personal data handling issues, consent violations | Custom rules |
| **OAuth** | OAuth/OIDC misconfigurations, insecure token handling | Custom rules |