Pencheff
Docs ↗Sign inOpen an account

Code security · Resources

Resources overview

Jump into setup guides, feature references, reporting conventions, API documentation, methodology pages, and workflow-specific playbooks.

Repository scanning gives source findings the same operational treatment as runtime findings: scanner provenance, line-level evidence, remediation guidance, SARIF, GitHub annotations, and fix state.

Start freeSign in
Task routerdocumented
8coverage areas
5operator steps
4evidence fields
Coverage8
Execution5
Evidence4
Controls4
DocsAPIReportsSupport

Operational paths point to setup, references, and the right next task for the workflow.

ScopeDocs, references, and playbooks
SectionResources
MethodDeterministic-first
OutputUnified evidence
ProfileCode security
01

Coverage

What does Resources overview test?

  • Everything needed to operate Pencheff
  • Jump into setup guides, feature references, reporting conventions, API documentation, methodology pages, and workflow-specific playbooks.
  • Dropdown section: Docs, references, and playbooks.
  • Semgrep OSS packs, Bandit, gosec, Brakeman, ESLint security, tree-sitter rules, and niche-language scaffolds.
  • Secret detection with gitleaks and suspicious-code indicators with YARA-style patterns.
  • GitHub repository connection, webhook-triggered scans, hardlink staging, gitignore-aware filtering, and default-deny controls.
  • SARIF and GitHub check run output so developers see findings where they work.
  • Auto-fix preparation for Semgrep autofix, SCA version bumps, and reviewer-friendly patch synthesis.
02

Execution

How does Pencheff run this?

  • Connect or register a repository and choose a branch, scan profile, and scanner policy.
  • Stage the source safely, fan out language-specific scanners, and capture raw scanner output.
  • Normalize results into repo findings with file, line, rule, severity, scanner, and remediation metadata.
  • Merge code results with SCA, IaC, secrets, and runtime context to reduce duplicate triage.
  • Send annotations, SARIF, reports, fix PRs, or dashboard tasks depending on the workflow.
03

Evidence

What evidence does this produce?

  • File path, line number, rule id, scanner name, confidence, language, and vulnerable snippet context.
  • Suggested fix, fixed-version data when applicable, and status across suppressions or rechecks.
  • GitHub check output, SARIF upload, comments, and links back into the finding record.
  • Cross-finding signals when a code pattern aligns with runtime exploitation.
04

Controls

How is this kept safe to run?

  • Scanner choices are explicit and permissively licensed where used in the repo pipeline.
  • Secrets are handled as findings rather than echoed into broad UI surfaces.
  • CI gates can be tuned by severity, reachability, policy, and target branch.
  • Generated fixes remain reviewer-owned and trace back to original scanner evidence.
↗

Documentation

Read the full reference.