> ## Documentation Index > Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt > Use this file to discover all available pages before exploring further. # Code Repository Scanning > Discover how the CybeDefend Engine unifies results from multiple scanners. CybeDefend offers a **multi-layered security** solution across your codebase, infrastructure, and third-party dependencies. We combine: 1. **CybeDefend Engine** – Aggregates and cross-references results from multiple open-source and proprietary scanners, minimizing duplicates and noise. CybeDefend Multi-Layer Security *** ## Why Use CybeDefend? * **Unified Scanning**: The CybeDefend Engine merges findings from different tools into a single, concise view. * **Reduced Noise**: Duplicate or overlapping vulnerabilities are identified and consolidated, preventing alert overload. *** ## 1. Static Application Security Testing (SAST) **SAST** inspects your **source code** to catch vulnerabilities early in the development process. CybeDefend unifies open-source scanners (e.g., **Semgrep**) under the **CybeDefend Engine**. ### Supported Languages | Language | Primary Scanners | | -------------- | ------------------------------------ | | **Go** | CybeDefend Engine & Rules + Opengrep | | **Python** | CybeDefend Engine & Rules + Opengrep | | **Java** | CybeDefend Engine & Rules + Opengrep | | **JavaScript** | CybeDefend Engine & Rules + Opengrep | | **C** | CybeDefend Engine & Rules + Opengrep | | **C++** | CybeDefend Engine & Rules + Opengrep | | **C#** | CybeDefend Engine & Rules + Opengrep | | **PHP** | CybeDefend Engine & Rules + Opengrep | | **Ruby** | CybeDefend Engine & Rules + Opengrep | | **Rust** | CybeDefend Engine & Rules | **Rust** is not supported by Opengrep — CybeDefend covers it with its own dedicated security rules, run by the CybeDefend Engine. IAC Security Analysis *** ## 2. Infrastructure as Code (IAC) Security IAC scanning ensures that **cloud** and **container** configurations adhere to best practices. The **CybeDefend Engine** works with scanners like **Checkov**, **Trivy**, and **KICS** to identify misconfigurations. Unlike SAST, enabling AI Mode for IAC does **not** provide line-level dataflow (which is primarily for code), but the Engine still handles **intelligent vulnerability matching** and deduplication. ### Supported Technologies | Category | IAC Types | Scanning Tools | | ------------------------ | -------------------------------------------------------------- | ---------------------------------------- | | **Cloud Configurations** | Terraform, CloudFormation, AWS CDK, Azure RM, Helm, Kubernetes | CybeDefend Engine + Checkov, KICS, Trivy | | **Serverless Security** | AWS Lambda, Azure Functions | CybeDefend Engine + Checkov, KICS | | **Container Security** | Dockerfiles, Docker Compose | CybeDefend Engine + Trivy, KICS | | **OpenAPI / gRPC** | .json, .yaml, .proto | CybeDefend Engine + KICS | IAC Security Analysis IAC misconfigurations can lead to severe breaches. The CybeDefend Engine identifies issues in your code, saving you from manually piecing together results from multiple scanners. *** ## 3. Software Composition Analysis (SCA) SCA detects vulnerabilities in **third-party libraries** and **open-source dependencies**. CybeDefend uses the **CybeDefend Engine** combined with **[Google OSV](https://osv.dev)** — the open-source vulnerability database maintained by Google — to identify known flaws in your dependencies. Rather than relying on a single feed, OSV **continuously aggregates and normalizes** advisories from **35+ language ecosystems and OS/distribution security trackers** into one source of truth. GitHub Advisories (GHSA) is one of the many databases OSV consolidates, so earlier coverage is fully retained — and considerably expanded. ### SCA Scanning Tools | Engine | External Advisory Source | | --------------------- | ------------------------------------------- | | **CybeDefend Engine** | **Google OSV** ([osv.dev](https://osv.dev)) | ### Vulnerability Data Sources (Google OSV) CybeDefend draws its SCA intelligence from **[Google OSV](https://osv.dev)** (Open Source Vulnerabilities), an open, distributed database that **aggregates and normalizes** advisories from across the open-source world into a single schema. This spans **language package registries** (npm, PyPI, Maven, NuGet, Go, crates.io, RubyGems, Packagist, Hex, and more) and **OS / distribution and container-image feeds** (Debian, Ubuntu, Alpine, Red Hat, SUSE, Rocky Linux, Chainguard, Wolfi, and many others) — with GitHub Advisories (GHSA) folded in as just one of the contributing sources. **These sources are aggregated continuously and grow every day.** New advisories — and entirely new ecosystems — are added to OSV constantly, and CybeDefend ingests them on an ongoing basis, so your scans always reflect the latest known vulnerabilities with no action on your side. The counts below are a **snapshot from [osv.dev](https://osv.dev), July 2026** — over **767,000** advisories across **38 sources** — and only trend upward. Check [osv.dev](https://osv.dev) for live figures. | Ecosystem | Advisories | Ecosystem | Advisories | | ----------- | ---------: | ---------------------------- | ---------: | | AlmaLinux | 5,242 | Alpaquita | 11,478 | | Alpine | 4,350 | Android | 3,403 | | Azure Linux | 12,016 | BellSoft Hardened Containers | 572 | | Bitnami | 8,264 | Chainguard | 9,229 | | CleanStart | 1,652 | crates.io | 2,561 | | Debian | 59,722 | Echo | 6,669 | | GIT | 93,379 | GitHub Actions | 54 | | Go | 8,148 | Hackage | 32 | | Hex | 182 | Julia | 989 | | Linux | 25,415 | Mageia | 6,011 | | Maven | 6,690 | MinimOS | 86,925 | | npm | 222,154 | NuGet | 1,770 | | openEuler | 7,186 | openSUSE | 13,449 | | OSS-Fuzz | 3,958 | Packagist | 6,664 | | PyPI | 22,362 | Red Hat | 21,177 | | Rocky Linux | 3,619 | Root | 17,380 | | RubyGems | 4,550 | SUSE | 21,326 | | SwiftURL | 58 | TuxCare | 5,651 | | Ubuntu | 57,187 | Wolfi | 6,451 | *The counts above reflect the **advisory data** OSV provides. Which ecosystems CybeDefend **parses from your project** — for dependency detection, license lookup, and exploitable paths — is listed under [Feature Support by Ecosystem](#feature-support-by-ecosystem) below.* ### Files & Package Managers Below is a non-exhaustive list of **key files** we inspect: | Language/Framework | File Examples | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Node** | `npm-shrinkwrap.json`, `yarn.lock`, `pnpm-lock.yaml`, `pnpm-lock.yml`, `bun.lock`, `deno.lock`, `libman.json`, `package.json`, `package-lock.json` | | **Java** | `gradle.lockfile`, `build.gradle`, `pom.xml` | | **Swift** | `Package.resolved`, `Podfile.lock` | | **.NET (NuGet)** | `packages.lock.json`, `Packages.props`, `.csproj`, `.vbproj`, `.fsproj`, `.nuspec` | | **Kotlin** | `gradle.lockfile` | | **Elixir** | `mix.lock` | | **C/C++** | `conan.lock` | | **Scala** | `build.sbt`, `plugins.sbt`, `dependencies.scala`, `libraries.scala`, `.sbt.lock` | | **Clojure** | `deps.edn` | | **Generic** | `composer.json`, `requirements.txt`, `Pipfile`, `Pipfile.lock`, `poetry.lock`, `pyproject.toml`, `Gemfile`, `Gemfile.lock`, `Cargo.toml`, `Cargo.lock`, `go.mod`, `pubspec.yaml`, `pubspec.lock`, `packages.config`, `Package.swift`, `rebar.config`, `rebar3.config`, `rebar.lock`, `rebar3.lock`, `.gemspec`, `.yml`, `.yaml` | Files like `bun.lockb` (binary Bun lockfile), `.jar` / `.war` / `.ear` (Java archives), and `.deps.json` (.NET build output) are **not supported** for SCA parsing. Use their text-based equivalents instead (`bun.lock`, `pom.xml` / `build.gradle`, `packages.lock.json`). ### Feature Support by Ecosystem Not all ecosystems support every SCA feature. The table below shows which features are available for each ecosystem: | Ecosystem | Dependency Detection | License Lookup | Exploitable Path | | ---------------------------------- | :------------------: | :------------: | :--------------: | | **npm / Yarn / pnpm / Bun / Deno** | ✅ | ✅ | ✅ | | **pip / Poetry / Pipenv** | ✅ | ✅ | ✅ | | **Maven / Gradle** (Java, Kotlin) | ✅ | ✅ | ✅ | | **Scala** | ✅ | ✅ | ✅ | | **Go modules** | ✅ | ✅ | ✅ | | **NuGet** (.NET) | ✅ | ✅ | ✅ | | **Composer** (PHP) | ✅ | ✅ | ✅ | | **Cargo** (Rust) | ✅ | ✅ | ✅ | | **Swift PM / CocoaPods** | ✅ | ✅ | ✅ | | **Pub** (Dart/Flutter) | ✅ | ✅ | ✅ | | **Hex** (Elixir/Erlang) | ✅ | ✅ | ✅ | | **RubyGems** (Ruby) | ✅ | ✅ | ✅ | | **Clojure** (Clojars) | ✅ | ✅ | ✅ | | **Conan** (C/C++) | ✅ | ✅ | ✅ | | **GitHub Actions** | ✅ | ✅ | ✅ | | **Rebar** (Erlang) | ✅ | ✅ | ✅ | If you use special file names or custom project layouts, you can configure file-patterns in the CybeDefend dashboard to ensure they are recognized and scanned. *** ## 4. Secret Scanning **Secret scanning** detects hardcoded secrets — API keys, tokens, passwords, private keys, and other credentials — exposed in your source code. CybeDefend runs **Gitleaks** under the **CybeDefend Engine** to surface these findings alongside your SAST, SCA, and IaC results in a single view. ### Secret Scanning Tools | Engine | Scanning Tool | | --------------------- | ------------- | | **CybeDefend Engine** | Gitleaks | *** **Related:** [Scan Parameters](/latest/code-scanning/scanning-options/scan-parameters) · [Create a Project](/latest/get-started/project-management/create-project) · [Cybe Analysis](/latest/agent-ai-integration/cybe-analysis-detail)