HiddenShadow — License + SBOM + CVE Scanner

Configure scan

Point at a directory or whole drive of cloned source repositories.

Source root

A directory tree, a single repo, or a whole drive root (e.g. C:\).

Output root (optional)

Artifacts (_logs/, sboms/) are written here.

Respect METADATA.yaml dispositions Detect hardcoded passwords & API keys Run code-quality / SAST rules (dangerous functions, shell injection, broken crypto, …) Check dependencies against OSV.dev for known CVEs (uses network) Behavioral monitor — infer runtime behavior (network egress, sensitive FS access, process spawns, env-var reads, persistence). No code is executed.

Recent scans

Saved scan history. Delete entries you don’t want to keep.

Scanning…

elapsed

0:00

Discovering repos…

critical

0

high

0

medium

0

low

0

info

0

Behavioral monitor inferred runtime behavior — no code executed

Scan complete

Export reports Each finding includes the recommended remediation.

Save to folder

Raw artifacts:

Severity	Repo	Finding	Location

Configure scan

Recent scans

Scanning…

Scan complete

Pick a directory