Skip to content

docs: describe five engines, four open-source plus the Synvoya engine #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Synvoya merged 1 commit into from
Nov 5, 2026
Merged

docs: describe five engines, four open-source plus the Synvoya engine #16

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,17 +32,17 @@ broad repository coverage.
If CodeInspectus is useful, [star the repository](https://github.com/Synvoya/codeinspectus)
so other AI-app builders can find it.

CodeInspectus orchestrates four best-in-class OSS engines behind one normalized,
CWE-keyed schema, and adds its own **AI-code-specific checks** that generic
scanners miss:
CodeInspectus runs **five engines** behind one normalized, CWE-keyed schema: four
best-in-class open-source engines, plus the **Synvoya engine**, our own, which carries the
**AI-code-specific checks** and recent advisories that generic scanners miss:

- **Opengrep** — SAST / OWASP Top 10 (SARIF)
- **Gitleaks** — secrets
- **Trivy** — dependency CVEs (SCA), IaC misconfig, secrets, SBOM, and licence findings when you opt in (`include_licenses: true` / `--licenses`; off by default)
- **osv-scanner** (Google) — offline dependency matching against OSV.dev data, including
OpenSSF malicious-package (`MAL-`) advisories. It runs only on the OSV databases you approved
for the ecosystems your repository uses
- **Synvoya (CodeInspectus)** — an offline gap-advisory layer for what those engines miss:
- **Synvoya engine (ours)** — an offline gap-advisory layer for what those engines miss:
declared Node.js, PHP, Python, Ruby, Go, .NET and Java versions (version-manager pins, manifests,
CI setup steps, image tags), end-of-life lines, exploited products such as Adobe Commerce and
WordPress core, malicious package versions, vendored and CDN-loaded JavaScript libraries (checked
Expand Down
Loading