Software / Code security
SourceScan
Find source-code security issues and track the fixes. SourceScan combines assisted analysis with expert review so your team can focus on validated findings and remediation.
Platforms and licensing
Supported platforms
Confirm current runtime, language and source-control support, including the permissions required for a repository connection.
Licensing
Subscription. Contact for pricing.
Development and support
GDF owns SourceScan and develops and maintains it in partnership with PNNX.
The product
What SourceScan does
A scanner result needs review of the affected code path and surrounding design. The reviewer checks whether the reported weakness is reachable and whether existing controls change the conclusion.
SourceScan combines expert-driven command-line analysis with a web dashboard. AI-assisted review helps organize candidate findings and code context, while the dashboard gives teams a place to assign remediation, track status and maintain oversight across the project.
Command-line analysis
Run expert-directed analysis close to the source repository and development workflow.
AI-assisted review
Use supported models to organize code context and candidate security findings for human assessment.
Finding validation
Review the affected path, reachability and surrounding controls before treating a candidate as an accepted finding.
Web dashboard
Track findings, ownership, severity, evidence and status outside the raw scanner output.
Remediation workflow
Assign corrective work, record developer response and retain the history behind risk acceptance or closure.
Security oversight
Give technical leaders a current view of open findings and remediation progress across supported projects.
Methodology
Typical workflow
-
Configure
Define repositories, languages, tool access, model boundaries and the rules for handling source code.
-
Analyze
Run expert-directed analysis and collect candidate findings with the relevant code context.
-
Validate
Review reachability, impact and compensating controls before accepting and prioritizing a result.
-
Track
Assign remediation, record decisions and verify corrected findings through the dashboard workflow.
Operating note
Compatibility and limits
Language support, repository connections, model options and deployment details vary by release. Source handling and approved model use should be agreed before analysis begins.
Visit SourceScanRelated software and services
Agree code access and validate a sample finding
Request current access and language, framework and repository support for the build being evaluated. Identify whether the workflow reads a repository, runs tools locally, writes issues or connects to CI. Grant only the permissions needed for the agreed actions.
- Code handling: identify deployment location, model providers, code or prompt transmission, provider retention and permitted training use before connecting confidential repositories.
- Scope: record the commit, included files, dependencies, generated code and paths excluded or unsupported.
- Validation: trace a candidate to an affected code path, required access, compensating controls and any runtime check separately authorized.
- Closure: retain the finding, developer response, corrected commit and verification result; record changes the scan could not assess.
For an illustrative authorization finding, the record can show the role expected to access a resource, the code path missing that check and the evidence supporting the concern. Static analysis does not prove runtime exploitability or replace an agreed penetration test.
SourceScan demonstration and access information · OWASP testing guidance for separately scoped validation
Talk with an examiner
Discuss this product for your engagement
Tell us the workflow and scale. We can discuss current availability, supported workflows and how it fits an examination or matter.
Since 1992 · 24/7 dispatch · Court-tested experts
Talk with an examiner
Discuss the matter and the next step.
Call to discuss timing, scope and the safest way to share information. Do not send evidence or credentials by email.
24/7 hotline: 1-800-868-8189