Scanner FAQ
One page per scanner. Every page follows the same shape:
- Category — what
.vetrix/tooling.ymlblock enables it. - Fingerprint scheme — how Vetrix dedupes its findings.
- When to enable — the language / ecosystem signal.
- Common false-positives — what reviewers see and can dismiss fast.
Index
| Scanner | Page | Category |
|---|---|---|
| gitleaks | gitleaks.md |
secrets (pre-receive) |
| TruffleHog | trufflehog.md |
secrets (CI verify) |
| Trivy | trivy.md |
sca + container |
| OSV-Scanner | osv-scanner.md |
sca |
| govulncheck | govulncheck.md |
sca (Go) |
| Dependency-Check | dependency-check.md |
sca (Java) |
| gosec | gosec.md |
sast (Go) |
| Semgrep | semgrep.md |
sast (polyglot) |
| Bandit | bandit.md |
sast (Python) |
| Brakeman | brakeman.md |
sast (Ruby/Rails) |
| Psalm | psalm.md |
sast (PHP) |
| phpcs | phpcs.md |
standards (PHP) |
| ESLint | eslint.md |
sast (JS/TS) |
| Ruff | ruff.md |
sast + standards (Python) |
| Checkov | checkov.md |
iac |