FAQ

Is my code sent anywhere?

No. The scan runs on your machine or in your CI. Your code is mounted read-only in a container. Results are written to your disk. You may choose to share the results, never the code.

Is it a penetration test?

No. It is an automated audit and triage layer. It complements a human review and does not replace one.

What does it scan?

Secrets, dependencies, code (local rules), infrastructure files (Terraform, Kubernetes, Dockerfile, CloudFormation) and, with the dedicated option, a container image. DAST is not part of the CLI: a passive DAST baseline on an authorized staging environment can be agreed upon as a separate service.

During the first online scan, AADSec downloads Trivy's vulnerability database into its local cache (about 1.6 GB measured on macOS); --offline uses the database from the image or the cache. The number of Trivy findings depends on the database in use: the totals in the sample report correspond to the database dated 26 October 2026 and may differ with a more recent database.

Which platforms are supported?

Platform statuses are published with each version, in the release notes on the Releases page of the aadieng100/aadsec-public repository.

Why only 3 scans?

The evaluation version limits successful scans per machine, to collect feedback before opening wider access.

Are SHA-256 sums signatures?

No. They are integrity checksums. They detect a modified or corrupted file; they do not authenticate the publisher. The SHA256SUMS file covers the binaries and archives, not the SBOM or the install scripts.

How do I report a vulnerability?

Write to contact@aadsec.xyz. Do not attach client code or client results.

What happens to my data when I visit the site?

See the privacy policy: the site uses no cookies and no analytics tool, but the host processes technical logs.