internal/

Package archive opens the containers that trust stores hide in, so the certificates packed inside them are scanned too: zip-family archives (jar, war, ear, whl, apk, zip), tar, cpio and ar archives, gzip, zstd, xz and bzip2 streams, Debian and RPM packages, and PyInstaller one-file executables.

Package cli is the command line shared by the engine binary and the thin per-detector binaries (emudhra-scan, php2shell-scan), which pin one detector and keep their old command names, flags and exit status rules.

Package engine defines what a detector is and runs detectors over a target.

Package host fetches the certificate chain a TLS server presents.

Package image opens a container image and yields its final filesystem.

Package refs finds container image references in a source repository: Dockerfiles and Containerfiles, Compose files, Kubernetes, OpenShift and Knative manifests (including rendered Helm output), Helm values files, and CI configuration (GitHub Actions, GitLab CI, Bitbucket Pipelines).

Package report renders scan results as text, JSON or SARIF.

Package source feeds files to the engine from a directory tree or a container image's flattened filesystem, and records every file it could not read so a scan never claims coverage it did not have.