v1.0
The initial release: static, dynamic and infrastructure scanning with DefectDojo integration.
The first release established what ScanSuite is: an orchestration platform that drives many security scanners from one console, normalises what they produce, and files the results somewhere a team can work with them.
Static analysis
Four analysis types over a source archive or a Git repository, each with its own scanners and its own report:
| Engine | What it covers |
|---|---|
| SAST | Static application security testing across the supported languages, with scanner selection driven by the project's main language. |
| Secrets scanning | Detection of keys, tokens and credentials committed to the repository. |
| Software Composition Analysis | Third-party components mapped to known CVEs from the project's manifests and lock files. |
| IaCS analysis | Infrastructure-as-code and control-system configuration review — Terraform, Kubernetes and cloud configuration risks. |
Dynamic scanning
Web application scanning with several profiles, so a scan could be matched to the moment it ran in rather than being one fixed cost:
- Quick — fast checks suitable for CI/CD smoke testing.
- Balanced — broader coverage for routine scans.
- Full and specialised — deep crawling and intrusive testing, plus focused scans such as technology discovery and hidden path enumeration.
- API scanning — parses an OpenAPI specification and tests the routes and parameters it declares. See Web API scans.
Infrastructure scanning
Five scan types against IPs, hostnames, subnets and ranges — asset discovery, vulnerability detection, OSINT reconnaissance, local patch validation over SSH and SMB/WMI, and Docker image scanning. Covered in Infrastructure Checks.
Platform capabilities
| Capability | Description |
|---|---|
| Custom rules | Team-specific rules for both the static (Semgrep) and dynamic (Nuclei) engines. See Custom Rules. |
| DefectDojo integration | Scan results exported per scanner into a central vulnerability management system. |
| Securitm integration | Automatic upload of infrastructure scan reports to SGRC Securitm. |
| CI/CD module | Scans launched from a build pipeline rather than the console. |
| Exploitable Vulnerabilities Database | An internal CVE database used to correlate and prioritise findings by real exploitation evidence rather than a severity label. |
| Scheduled scans | Recurring execution for continuous monitoring. |
| Manual report upload | Import a report produced elsewhere so all findings land in one place. |
The exploitable vulnerabilities database introduced here became the backbone of several later features — dependency gating, the pentest agent's exploit research, and the CVE lookups during infrastructure scans. See Exploitable Vulnerabilities Database.
Last reviewed 2026-08-16