QFinch SAST runs a governed engine ensemble selected for the repository's detected languages and files. Findings retain engine and ruleset provenance, location, severity, category and remediation context.
Build-aware Java analysis
Supported Maven repositories are built before SpotBugs so bytecode analysis can inspect compiled project classes. Dependency JARs are treated as auxiliary classpath, and packaged application JARs are not rescanned when their compiled classes are already available.
More than one result type
The report distinguishes vulnerability findings, attack surface, security hardening, code-quality context, IaC misconfiguration and secrets rather than presenting every observation as the same kind of risk.
Transparent coverage
Unavailable, failed, inapplicable and warning engines remain visible. A successful scan means the reported engines completed according to their contract; it is not proof that the repository contains no weaknesses.
CTA: Connect a repository