GDF Software for Source Code Security Review and Remediation Tracking
SourceScan Delivers Validated Findings Tracked to the Last Fix
A scanner hands your developers hundreds of candidates and no way to tell which ones an attacker can reach. SourceScan pairs expert directed analysis and AI assisted review with a dashboard that validates each finding in its code path and follows it through remediation to a verified fix. GDF owns it, developed it with PNNX, and uses it beside the hands on source code reviews our engineers deliver.
Platforms, Licensing and Who Stands Behind It
Supported Operating Systems and Platforms
SourceScan connects to source control systems, including GitHub, and runs across platforms. Confirm the current runtime, language and source control support, together with the permissions a repository connection requires, during your walkthrough.
Software Licensing and Deployment Models
SourceScan is licensed by subscription. Contact GDF for current pricing and the terms that fit your team.
Engineering Development and Enterprise Support
GDF owns SourceScan and develops and maintains it in partnership with PNNX. The firm that built the platform is the firm that maintains it.
The product
A Scanner Alert Is Where the Work Starts
Every application security team knows the pattern. A scanner reports hundreds of candidates, developers lose a week chasing the ones that cannot be reached, and the weakness that matters sits unexamined in a path no rule described. A reported weakness only means something once someone has read the affected code path and the design around it, asked whether an attacker can actually reach it and checked whether an existing control changes the answer.
SourceScan was built by Global Digital Forensics, a firm that has served security programs and law firms since 1992 and whose founder has written and examined software since 1980, to make that judgment faster and keep a record of it. Expert directed command line analysis runs close to your repository and development workflow. AI assisted review, using supported models, organizes code context and candidate findings for human assessment. A web dashboard then gives your team one place to assign remediation, track status and keep oversight across the project, so the history behind every accepted, fixed or risk accepted finding survives staff changes and audit questions.
Command line analysis
Run expert directed analysis close to the source repository and the development workflow, where the code and the people who wrote it already are.
AI assisted review
Use supported models to organize code context and candidate security findings into a form a human reviewer can assess quickly and defend later.
Finding validation
Review the affected path, its reachability and the surrounding controls before a candidate becomes an accepted finding, so the fix list contains only real work.
Web dashboard
Track findings, ownership, severity, evidence and status in one place instead of in raw scanner output and email threads.
Remediation workflow
Assign corrective work, record each developer response and retain the history behind every risk acceptance or closure.
Security oversight
Give technical leaders a current view of open findings and remediation progress across every supported project.
Have a repository and a backlog of findings nobody has had time to read? Tell us the languages and the workflow and we will show you how SourceScan handles the first candidate.
Methodology
Four Steps From Repository Access to a Verified Fix
-
Configure
Define the repositories, languages, tool access, model boundaries and the rules for handling your source code before any analysis runs.
-
Analyze
Run expert directed analysis and collect candidate findings together with the code context a reviewer needs to judge them.
-
Validate
Review reachability, impact and compensating controls so only accepted, prioritized findings reach your developers.
-
Track
Assign remediation, record the decisions and verify corrected findings through the dashboard until each one is closed.
Operating note
What to Agree Before the First Scan
Language support, repository connections, model options and deployment details vary by release, so we confirm them against your environment before you rely on them. Source handling and approved model use should be agreed before analysis begins, and a walkthrough is the fastest way to settle both.
Settle the source handling question first: ask for the walkthrough and bring your model and deployment constraints to it.
Visit SourceScanRelated Proprietary Software and Forensic Services
How to Evaluate Source
Ask us for current access and for language, framework and repository support for the build you want to evaluate. Establish whether the workflow you need reads a repository, runs tools locally, writes issues or connects to CI, and grant only the permissions the agreed actions require.
Code handling comes first. Before a confidential repository is connected, identify where the platform is deployed, which model providers are involved, whether code or prompts are transmitted, how long a provider retains them and whether any training use is permitted.
Scope the evaluation like an engagement. Record the commit, the included files, the dependencies, the generated code and the paths that are excluded or unsupported. Then take one candidate and trace it to the affected code path, the access it requires, the compensating controls around it and any runtime check that has been separately authorized.
Close the loop. Retain the finding, the developer response, the corrected commit and the verification result, and record the changes the scan could not assess.
An illustrative authorization finding shows what the record looks like: the role expected to reach a resource, the code path missing that check and the evidence supporting the concern. SourceScan works beside our source code security review and application penetration testing, which confirm runtime exploitability on the paths it flags.
SourceScan demonstration and access information · OWASP testing guidance for separately scoped validation
If a static finding needs its runtime path proven, the next conversation is a separately scoped application penetration test, and we will scope both together if you ask.
Talk with an examiner
Put Source
Tell us the languages, the repositories and the scale of the codebase. A senior security engineer will call or write back promptly to discuss the supported workflows and how SourceScan fits your security program or the matter in front of you.
GDF has operated since 1992, and the 24/7 hotline at (800) 868-8189 reaches a practice that includes court tested experts.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .