Transparency

What we scan with.

A security report is only as trustworthy as the intelligence behind it. Here is every external database and open-source ruleset SecNxt uses, what each one contributes, and the licence it carries — so you and your auditors can check our work.

Vulnerability databases

Queried live during a scan. These tell us whether a specific package version is known to be vulnerable, whether the flaw is being exploited in the wild, and how likely exploitation is.

OSV.dev

Live lookup

Authoritative advisories for open-source packages. Every dependency and version we parse is matched against OSV to determine whether a known vulnerability affects it.

Engines: SCA, SBOM, Container
Licence: CC-BY-4.0 (data), Apache-2.0 (schema)
Source: osv.dev

CISA Known Exploited Vulnerabilities (KEV)

Live lookup

The US government's list of vulnerabilities confirmed to be exploited in the wild. A KEV match escalates a finding's priority regardless of its CVSS score.

Engines: SCA, SBOM
Licence: US Government public domain
Source: www.cisa.gov/known-exploited-vulnerabilities-catalog

FIRST EPSS

Live lookup

A daily-updated probability that a given CVE will be exploited in the next 30 days. Used to rank remediation order so the riskiest work comes first.

Engines: SCA, SBOM
Licence: Free for any use, attribution requested
Source: www.first.org/epss/

Open-source rulesets

Detection rules published by the security community under permissive licences. We vendor the rules themselves and run them inside our own engines, so scans stay fast and no code leaves the platform.

Gitleaks rules

Vendored rules

Community-maintained credential detection patterns for cloud providers, SaaS APIs, package registries and private keys. Adopted in full and executed by our own secrets engine.

Engines: Secrets
Licence: MIT
Source: github.com/gitleaks/gitleaks

Nuclei templates

Vendored rules

Community web-vulnerability templates describing a request, a response matcher and a severity. Interpreted natively by our active-scan engine.

Only HTTP templates using the standard matcher types are supported. Templates that require network protocols, external binaries or code execution are skipped.

Engines: DAST, API
Licence: MIT
Source: github.com/projectdiscovery/nuclei-templates

Checkov / KICS policies

Vendored rules

Declarative infrastructure-as-code policies for Terraform, CloudFormation, Kubernetes and container images, mapped onto our configuration rule evaluator.

Engines: IaC, CSPM, KSPM
Licence: Apache-2.0
Source: github.com/bridgecrewio/checkov

Semgrep OSS rules

Vendored rules

Community secure-coding rules for JavaScript, TypeScript, Python, Java, Go, PHP and Ruby, used alongside SecNxt's own SAST rules.

Only rules expressible as textual patterns are adopted. Rules requiring full abstract-syntax-tree or dataflow analysis are not included, and SecNxt's own rules remain the primary detection layer.

Engines: SAST
Licence: LGPL-2.1 (rules kept as unmodified data)
Source: github.com/semgrep/semgrep-rules

OWASP Top 10 & ASVS

Vendored rules

Categorisation of every finding against a recognised industry taxonomy, plus the VAPT methodology checklists.

Engines: All engines
Licence: CC-BY-SA
Source: owasp.org

MITRE CWE

Vendored rules

Weakness classification (CWE-ID) attached to every finding for auditor traceability.

Engines: All engines
Licence: Free to use, attribution to MITRE
Source: cwe.mitre.org

FIRST CVSS v3.1

Vendored rules

Base and environmental severity scoring, including the customer-context adjustments applied in VAPT reports.

Engines: All engines
Licence: Free for any use
Source: www.first.org/cvss/

Registries & standards

The reference catalogues we map every finding to, so a result means the same thing to your auditor as it does to your engineers.

npm registry

Live lookup

Resolving JavaScript package metadata, latest safe versions, and deprecation status.

Engines: SCA, SBOM
Licence: Public registry API
Source: registry.npmjs.org

PyPI

Live lookup

Resolving Python package metadata and fixed-version information.

Engines: SCA, SBOM
Licence: Public registry API
Source: pypi.org

How to read this

Live lookup means we query the source during your scan, so you get today's data rather than a snapshot from whenever we last shipped.
Vendored rules means we have adopted the published detection rules into our own engines. Your code is never uploaded to a third-party tool, and scans stay fast enough to run on every commit.
Provenance on every finding. Where a result came from a community ruleset, the finding and the PDF report say so and link back to the upstream project. Everything else is a SecNxt in-house rule.
We do not resell other people's verdicts. External data tells us what is known to be vulnerable; deciding whether it actually affects your system — and proving it — is our engines' job.

See it on your own code

Run a scan and every finding will cite the rule and the source behind it.

Start scanning