Clones the target repository into an isolated temporary directory — never into the active project workspace. Supports both public and private repos with credential prompting.

Scans source files for security anti-patterns, hardcoded secrets, and unsafe code constructs. Covers injection vectors, auth flaws, and cryptographic misuse.

Cross-references all dependency manifests against CVE databases. Identifies known vulnerabilities and supply-chain risks in your dependency tree.

Aggregates all findings into a structured PDF/Markdown report with severity ratings, systemic weakness analysis, and exact remediation guidance.