Analyzing project structure to identify languages and package managers...
Scanning for hardcoded credentials, API keys, and tokens...
Checking dependencies for known vulnerabilities (CVE/OSV)...
Running Semgrep and Bandit for security patterns...
Evaluating findings against security policy gates...