Security Scanning
Dam Secure runs security analysis across the entire agentic software development lifecycle. From the moment an agent starts planning, through code generation, into pull requests, and against the codebase on main. Each layer is a backstop for the one before it.
Every scan uses the same shared engine:
- Rules - your security policies, scoped to the repositories & projects they apply to.
- Security Knowledge Graph - built during repository onboarding, so scans understand your code structure, not just the text.
- Issues - what the scan produces. Each violation is checked by AI Triage before it surfaces as a sub-issue (one per file or location), grouped under an issue per rule for triage.
A sub-issue from a pull request scan looks the same as a sub-issue from a baseline scan. Triaging an issue once carries that decision across re-scans.
Vulnerability Categories
Dam Secure ships with rules spanning ten vulnerability categories, covering classic application security, cloud/infrastructure risk, and AI-specific threats.
Access Control
Flags missing or broken authentication and authorization, including IDOR/BOLA, cross-tenant data access, and unprotected AI or MCP endpoints.
Injection Flaws
Flags untrusted input reaching a dangerous sink, including SQL/command injection, path traversal, SSRF, and cross-site scripting.
LLM & Agent Security
Flags AI-specific risks, including prompt injection, unsafe agent tool-call execution, cross-tenant leakage, and unsafe model output handling.
Business Logic
Flags workflow abuse by authorized users, including race conditions, replay attacks, incorrect calculations, and quota abuse.
Cryptographic Failures
Flags weak cryptography and token handling, including forged signatures, hardcoded keys, weak randomness, and improper token expiry.
IaC & Cloud Config
Flags insecure infrastructure-as-code and cloud configuration, including permissive IAM policies, exposed storage or ports, and insecure container defaults.
Secrets & Credentials
Flags hardcoded secrets and credentials, including weak or default passwords, secrets committed to version control, and unencrypted storage.
Logging & Alerting
Flags gaps in security logging, including log injection, missing audit trails on sensitive actions, and silently swallowed exceptions.
Privacy & Data Handling
Flags unauthorized data egress, missing consent or privacy-mode checks, and sensitive data written to logs or analytics without classification.
Dependencies
Flags risks from third-party dependencies, including known-vulnerable packages, unpinned or tampered versions, and malicious transitive dependencies.
OWASP Top 10 Coverage
Our vulnerability categories map onto the OWASP Top 10 (2025). The mapping is many-to-many: a category can span multiple OWASP items, and an OWASP item can be covered by more than one category.
| Dam Secure Vulnerability Category | OWASP Top 10 (2025) |
|---|---|
| Access Control | A01 Broken Access Control, A07 Authentication Failures |
| IaC & Cloud Config | A02 Security Misconfiguration |
| Secrets & Credentials | A02 Security Misconfiguration |
| Dependencies | A03 Software Supply Chain Failures, A08 Software or Data Integrity Failures |
| Cryptographic Failures | A04 Cryptographic Failures |
| Injection Flaws | A05 Injection, A08 Software or Data Integrity Failures |
| Business Logic | A06 Insecure Design, A10 Mishandling of Exceptional Conditions |
| Logging & Alerting | A09 Security Logging and Alerting Failures |
| Privacy & Data Handling | — |
| LLM & Agent Security | See OWASP Top 10 for LLM Applications |
Where we fit into your workflow
| Stage | Scan | Catches |
|---|---|---|
| Planning | Agentic Plan Scan | Insecure approaches before code is written |
| Local development | Local Scan | Vulnerabilities in unstaged changes |
| Pull request | Pull Request Scan | Issues introduced or newly exposed by a change before merge |
| Main branch | Baseline Repository Scan | The current security state of your codebase |
Agentic Plan Scans
Before an agent writes any code, Dam Secure reviews its plan against your rules. The scan extracts the files the plan intends to change, matches them to the projects they touch, and surfaces only the rules that apply to that specific work tailored guidance rather than a generic policy dump.
This scan is delivered through Secure Spec, which hooks into the planning lifecycle in Cursor, Claude Code, and Copilot. See the Secure Spec installation guide to set it up.
Local Scan
Local Scan runs against unstaged or uncommitted changes in your working tree — catching issues during the inner development loop, before a commit is even pushed.
Pull Request Scan
Dam Secure scans a pull request when it is opened and ready for review, or when it is converted from draft to ready. Draft pull requests are not scanned.
Once the repository is connected and rules are enabled, scans run automatically. In Settings you can scan only when a PR opens, or again on every pushed commit. Draft PRs stay unscanned in either case.
What the scan looks at
The scan starts from the PR's changed lines. From there the agent can read the entire file, follow call paths, and verify existing security controls across the repository.
Findings must be introduced or newly exposed by the PR, and anchored to those changed lines. Unchanged code can act as supporting context. A pre-existing issue that the PR neither introduces nor newly exposes is out of scope for the PR scan — that is what the baseline repository scan covers.
How to read a finding's PR
- Open PR — the finding is on an unmerged change. Investigate before merge.
- Merged PR — treat the finding as live. The change has landed on the default branch (and in production, if that is how you ship). Issues raised when the PR opened but then fixed in a later commit on that PR are checked and resolved automatically on merge.
- Draft PR — draft PRs are not scanned. A finding linked to a PR that is now a draft usually means the PR was scanned while ready, then converted to draft afterwards.
- Closed without merging — the finding is retired automatically. It remains visible, but is filtered out of the portal, APIs, and MCP by default.
When a scan completes, Dam Secure produces a GitHub check run with pass / fail status and comments on the PR. Dam Secure can block a PR until a configurable severity of issues is resolved (for example, block until all High or above issues have been resolved).
Baseline Repository Scan
A baseline scan evaluates the entire repository at the current state of the default branch. It populates the issue inbox with everything currently in violation of your rules.
