Documentation
What each scanner looks for, where its results come from, and when it runs.
Vulnetix covers the whole surface rather than one slice of it, because attackers do not respect the boundary between your code and the code you depend on.
Each scanner below explains what it finds, what triggers it, and how to tune it. If you are trying to work out why a particular finding appeared, or did not, start with the relevant page here.
| Trigger | What runs |
|---|---|
| As you type | Code, infrastructure and container rules. Local only, never the network. |
| On save | The above, plus secrets. Plus dependencies, if you saved a manifest and its contents actually changed. |
| On demand | Everything, including licences, malware scanning and SBOM generation. |
Secrets are separated from the typing path deliberately: they are by far the largest part of the rule set, and running them on every keystroke would make the editor feel slow to check for something that cannot be true until you have finished typing it. The reasoning, with measurements, is on performance.