internal/

Package archive opens the containers that trust stores hide in, so the certificates packed inside them are scanned too: zip-family archives (jar, war, ear, whl, apk, zip), tar, cpio and ar archives, gzip, zstd, xz and bzip2 streams, Debian and RPM packages, and PyInstaller one-file executables.

Package cli is the command line shared by the engine binary and the thin per-detector binaries (emudhra-scan, php2shell-scan), which pin one detector and keep their old command names, flags and exit status rules.

Package engine defines what a detector is and runs detectors over a target.

Package host fetches the certificate chain a TLS server presents.

Package image opens a container image and yields its final filesystem.

Package report renders scan results as text, JSON or SARIF.

Package source feeds files to the engine from a directory tree or a container image's flattened filesystem, and records every file it could not read so a scan never claims coverage it did not have.