The scanner ensemble
Nine scanners, one merged result.
CloudShield runs multiple independent security scanners and merges their output into a single, de-duplicated set of findings. When two scanners flag the same line for the same weakness, you see one finding with both scanners credited — and cross-scanner agreement raises its confidence score.
| Scanner | Focus |
|---|---|
| Semgrep | Multi-language SAST (JavaScript, TypeScript, Python, Go, Java, and more) |
| Snyk Code | Proprietary taint analysis |
| Bandit | Python security |
| Gosec | Go security |
| Brakeman | Ruby on Rails |
| cppcheck | C / C++ static analysis |
| Flawfinder | C / C++ dangerous-function analysis |
| Trivy | Package CVEs (software composition analysis) |
| OSV Scanner | Dependency vulnerabilities from lockfiles via the OSV.dev database |
Scanners only run when matching files exist — enabling all nine on a Python-only instance costs nothing extra, because the others skip automatically. The Basic configuration on the new-scan page runs the full recommended set; Advanced lets you pick individual scanners.
OSV Scanner
OSV Scanner is CloudShield's second software-composition scanner, complementing Trivy.
Where Trivy inspects the packages installed on an SSH target, OSV Scanner walks the
collected source tree for dependency manifests and lockfiles — package.json and its
lockfiles, requirements.txt, poetry.lock, go.mod, Cargo.lock, pom.xml,
Gemfile.lock, and more — and matches every declared dependency against Google's
OSV.dev vulnerability database. Because it reads lockfiles rather
than an installed-package inventory, it also works on Git repository targets.
When both scanners flag the same package version for the same CVE, the results merge into a single vulnerability credited to both. If a directory contains no recognizable manifests or lockfiles, the scanner completes with zero results at no time cost.