Method

Six steps, no surprises, and a scope written down before anything is scanned.

A typical first engagement runs three to six weeks depending on repository count and how much of the estate is private. Interim findings arrive before the report, because the expensive findings are the ones you learn about late.

Sequence

  1. Scope

    We tier the estate before quoting it: what ships to customers, what runs as a hosted service, what is internal. Tiering usually cuts the audited surface substantially, and it makes the price defensible internally.

    Output — written scope, tiering, engagement shape

  2. Access

    Access is arranged the way your security team prefers: an on-site session, a jump host, or outside-collaborator access to specific private repositories. Private repos are the usual scheduling risk, so this step starts early.

    Output — access plan, environment check, dry run

  3. Scan

    The CLI runs inside your environment against a pinned commit. Declared dependencies, vendored trees, build inputs and source fragments are all processed in place. What crosses the boundary is component metadata and match evidence — never source.

    Output — raw findings set, pinned to a commit

  4. Review

    Machine output is not an audit. Every material finding is reviewed by hand: false matches dropped, dual licensing resolved, obligations read against how you actually distribute. This is the step that separates a report from a scanner dump.

    Output — reviewed findings, interim read

  5. Report

    The report states each finding, the evidence behind it, and the reasoning — so a reader can disagree with a call on its merits. Inventories, obligation matrix and notice set ship alongside it in machine-readable form.

    Output — audit report, SBOMs, obligation matrix, notices

  6. Remediation

    Findings are ordered by exposure against effort, with a recommended disposition for each: replace, isolate, relicense, comply, or accept with the reason recorded. A re-scan confirms what actually got fixed.

    Output — remediation plan, confirming re-scan

Data handling

The boundary your code does not cross.

Traditional audits ask you to ship a source archive to a vendor. That is the single biggest reason audits get delayed, scoped down, or skipped entirely. This practice is built the other way around.

Stays

Source, archives, snapshots

Everything remains inside your environment, under your access controls, for the whole engagement and after it.

Leaves

Component metadata, match evidence

Anonymized findings sufficient to write the report — component identities, versions, licenses, and the spans that matched.

Retained

The report, and nothing more

You own the deliverables. We retain the scanning tooling and corpus we brought with us; no client code is kept, reused or trained on.

Concern How it is handled
Private repositories Scoped outside-collaborator access or an on-site session — arranged in the access step so it never becomes the critical path.
Regulated environments The scanner runs where the code already lives, so no new data-transfer approval is required to start.
Pre-announcement transactions Engagements run under the transaction's own confidentiality terms; the sell side keeps control of the environment throughout.
Reproducibility Findings are pinned to a commit and regenerable from the same inputs, so the report can be defended a year later.

From you

What the audit needs from your side.

  • A repository list and a distribution answer

    Which repositories ship, and how — hosted, on-premises, embedded, or distributed to customers to run themselves. Obligations follow distribution, so this single answer shapes most of the findings.

  • One engineer who can answer questions

    Not full-time. Someone who knows what is vendored, which forks are live and which repositories are dead but never archived. A few hours across the engagement.

  • Access, arranged early

    Read access to the audited repositories and, where relevant, the build so the artifact can be inspected rather than inferred.

  • Your existing policy, if there is one

    Approval rules, banned-license lists, prior audit reports. Findings are more useful when they say where your own controls would have caught it.

Bring the deadline, and we will work back from it.

Submission dates, customer reviews and deal clocks all set the shape of the engagement. Say what you are working toward and you will get a scope back, not a proposal deck.

Scope an audit