ArchSecurity - Security scanning (SAST)
ArchSecurity performs CWE-tagged static analysis (SAST) and turns a single scan into four compliance frameworks.
CWE backbone
Section titled “CWE backbone”Every finding is tagged with a CWE identifier. The framework reports are derived from this single backbone:
| Framework | Scope |
|---|---|
| OWASP Top 10 | The 10 most common web risks |
| PCI-DSS | Card data compliance |
| STIG | Hardening guides |
| CASA | Application security assessment |
Scan → CWE-tagged finding → CWE→framework mapping → compliance report ordered by severity
The scan runs on your infrastructure; your source code never leaves your infrastructure.
Findings from other scanners
Section titled “Findings from other scanners”If a workspace connects GitLab security scanning or SonarQube, their open findings are mirrored next to ArchSecurity’s own - per source, never merged into one total: two tools disagreeing about a repository is information, and a combined number would hide which one saw what.
- The dashboard shows one card per source with its severity mix and the projects it covers.
- Each finding links back to the scanner that raised it.
- Mirroring is one-way and honest: a finding that disappears at the source is marked resolved here, nothing is re-scored.