The five layers of a release gate
A single scan should look at code, dependencies, secrets, configuration, and the running app. Here is why each layer matters.
- security
- engineering
Most scanners look at one slice of a codebase and call it done. A real release gate has to reason across the whole surface, because a launch-blocking problem can hide in any one of them. VibeZero scans five layers on every run.
1. Code
Static analysis over your source finds the classic issues: injection paths, unsafe deserialization, weak crypto, and logic that leaks data. This is the layer people expect, and it is table stakes.
2. Dependencies
The code you did not write is still code you ship. We resolve your lockfiles and match them against known vulnerability data, so an outdated transitive package does not become your incident.
3. Secrets
A key committed to the repo is one of the fastest ways to get compromised. We look for credentials in source and history, and we mask them in every report so the finding never becomes a second leak.
4. Configuration
Infrastructure and framework settings decide how exposed you are in production: permissive CORS, public storage buckets, debug flags left on. Misconfiguration is quiet until it is not.
5. The running app
Static checks cannot see everything a live endpoint does. With proof that you own the deployed target, dynamic checks confirm whether an issue is actually reachable in the running system.
One decision, not five reports
The point of scanning all five layers is not to hand you five separate reports. It is to correlate what they find, drop the duplicates, and produce a single release decision with a short list of blockers. That is the number you can take to a launch meeting.