Security Scanning
Dam Secure runs security analysis across the entire agentic software development lifecycle. From the moment an agent starts planning, through code generation, into pull requests, and against the codebase on main. Each layer is a backstop for the one before it.
Every scan uses the same shared engine:
- Rules - your security policies, scoped to the repositories & projects they apply to.
- Security Knowledge Graph - built during repository onboarding, so scans understand your code structure, not just the text.
- Issues - what the scan produces. Each violation is checked by AI Triage before it surfaces as a sub-issue (one per file or location), grouped under an issue per rule for triage.
A sub-issue from a pull request scan looks the same as a sub-issue from a baseline scan. Triaging an issue once carries that decision across re-scans.
Vulnerability Categories
Dam Secure ships with rules spanning ten vulnerability categories, covering classic application security, cloud/infrastructure risk, and AI-specific threats.
Access Control
Flags missing or broken authentication and authorization, including IDOR/BOLA, cross-tenant data access, and unprotected AI or MCP endpoints.
Injection Flaws
Flags untrusted input reaching a dangerous sink, including SQL/command injection, path traversal, SSRF, and cross-site scripting.
LLM & Agent Security
Flags AI-specific risks, including prompt injection, unsafe agent tool-call execution, cross-tenant leakage, and unsafe model output handling.
Business Logic
Flags workflow abuse by authorized users, including race conditions, replay attacks, incorrect calculations, and quota abuse.
Cryptographic Failures
Flags weak cryptography and token handling, including forged signatures, hardcoded keys, weak randomness, and improper token expiry.
IaC & Cloud Config
Flags insecure infrastructure-as-code and cloud configuration, including permissive IAM policies, exposed storage or ports, and insecure container defaults.
Secrets & Credentials
Flags hardcoded secrets and credentials, including weak or default passwords, secrets committed to version control, and unencrypted storage.
Logging & Alerting
Flags gaps in security logging, including log injection, missing audit trails on sensitive actions, and silently swallowed exceptions.
Privacy & Data Handling
Flags unauthorized data egress, missing consent or privacy-mode checks, and sensitive data written to logs or analytics without classification.
Dependencies
Flags risks from third-party dependencies, including known-vulnerable packages, unpinned or tampered versions, and malicious transitive dependencies.
OWASP Top 10 Coverage
Our vulnerability categories map onto the OWASP Top 10 (2025). The mapping is many-to-many: a category can span multiple OWASP items, and an OWASP item can be covered by more than one category.
| Dam Secure Vulnerability Category | OWASP Top 10 (2025) |
|---|---|
| Access Control | A01 Broken Access Control, A07 Authentication Failures |
| IaC & Cloud Config | A02 Security Misconfiguration |
| Secrets & Credentials | A02 Security Misconfiguration |
| Dependencies | A03 Software Supply Chain Failures, A08 Software or Data Integrity Failures |
| Cryptographic Failures | A04 Cryptographic Failures |
| Injection Flaws | A05 Injection, A08 Software or Data Integrity Failures |
| Business Logic | A06 Insecure Design, A10 Mishandling of Exceptional Conditions |
| Logging & Alerting | A09 Security Logging and Alerting Failures |
| Privacy & Data Handling | — |
| LLM & Agent Security | See OWASP Top 10 for LLM Applications |
Where we fit into your workflow
| Stage | Scan | Catches |
|---|---|---|
| Planning | Agentic Plan Scan | Insecure approaches before code is written |
| Local development | Local Scan | Vulnerabilities in unstaged changes |
| Pull request | Pull Request Scan | Issues introduced by a change before merge |
| Main branch | Baseline Repository Scan | The current security state of your codebase |
Agentic Plan Scans
Before an agent writes any code, Dam Secure reviews its plan against your rules. The scan extracts the files the plan intends to change, matches them to the projects they touch, and surfaces only the rules that apply to that specific work tailored guidance rather than a generic policy dump.
This scan is delivered through Secure Spec, which hooks into the planning lifecycle in Cursor, Claude Code, and Copilot. See the Secure Spec installation guide to set it up.
Local Scan
Local Scan runs against unstaged or uncommitted changes in your working tree — catching issues during the inner development loop, before a commit is even pushed.
Pull Request Scan
When a pull request is opened, Dam Secure scans the diff against your enabled rules. The scan produces a GitHub check run with pass / fail status and comments on the PR.
Dam Secure can block a PR until a certain level of (configurable) issues are resolved (e.g. block PR until all issues that are marked as High or above have been resolved).
PR scans run automatically once your repository is connected and rules are enabled. You manage this behaviour via Settings.
Baseline Repository Scan
A baseline scan evaluates the entire repository at the current state of the default branch. It populates the issue inbox with everything currently in violation of your rules.
