/security-scan — 6-Layer Security Pipeline

What

Runs a defense-in-depth static scan across 6 layers. A project with zero CVEs can still have hardcoded secrets, SQL injection, and missing auth — each layer catches a different vulnerability class. Findings map to the OWASP Top 10:2025 taxonomy and are rated Critical/High/Medium/Low by exploitability, impact, and exposure — a Critical SQL injection on a public endpoint outranks a Low info-disclosure on an admin page.

Detection patterns, OWASP mappings, remediation code, and the report template live in references/scan-layers.md — read it before executing.

Honesty rule: this is static analysis, not a penetration test. It catches known patterns but misses business-logic flaws, complex authorization bypasses, and runtime-only vulnerabilities. Every report states this.

When