Secret detection
Detects high-signal committed credential patterns while masking sensitive evidence in the resulting report.
Product
Repository analysis that stays understandable as the report gets deeper.
GSkout combines dependency, source-code, configuration and repository signals into one investigation model. Findings are separated by severity, confidence and category so maintenance warnings do not look identical to real security vulnerabilities.
One repository. Several focused analyzers.
Each analyzer focuses on a specific class of repository signal. GSkout combines their output into one report rather than forcing the user through separate tools.
AST-aware source security
Inspects JavaScript and TypeScript syntax instead of relying entirely on simple text matching.
Source → sink context
Raises stronger findings when request-controlled input can be connected to dangerous execution or rendering sinks.
Dependency intelligence
Combines installed package versions with registry metadata and vulnerability advisory information.
Configuration checks
Analyzes selected Next.js, Docker, environment, Vercel and GitHub Actions configuration.
File intelligence
Maps findings back to repository files and exposes severity and finding counts at file level.
Source security
Understand dangerous code in context.
A call to a sensitive API can matter, but not every use has the same security implications.
GSkout uses AST-aware inspection to recognize selected dangerous JavaScript execution primitives. Lightweight framework-aware source tracking adds higher-confidence findings when request input reaches a sensitive sink.
req.body.address ↓ string concatenation ↓ child_process.exec()
Dependencies
Know whether dependency security was actually evaluated.
GSkout does not label a dependency safe when its installed version cannot be determined.
Packages with an unresolved installed version are clearly marked as not evaluated. Known advisories can expose external references, patched versions and cases where no patched release is available.
Findings
Security and maintenance are not the same thing.
Findings are organized into meaningful categories such as security, maintenance and configuration.
Critical and high security findings can therefore remain visible without allowing package age or deprecation notices to dominate the report.
Repository health is separate from dependency health.
The repository health score combines source security, dependency condition, analysis coverage and analysis quality. The report exposes its components so the score remains understandable.
Understand the health scoreHigh signal by design.
GSkout V1 focuses on actionable JavaScript and Node.js repository signals. It is not presented as a complete replacement for enterprise SAST, secret-management or supply-chain platforms.