0x00// Anthauri Recon · Security scans for code
Find what your repositories leak. The scan sends your code nowhere.
Anthauri Recon looks for leaked secrets, customer data left in files, vulnerable dependencies, code flaws and risky configuration. It runs in your own CI or on ANTHAURI machines under contract, and writes one report where every secret and personal value is masked.
- No upload, no hosted service
- Masked reports
- Every critical and high finding checked by a person
- [1] secrets gitleaks
- [2] customer-data built-in
- [3] dependencies osv-scanner
- [4] code semgrep
- [5] configuration trivy
out: report.md · report.sarif · report.json
// What it checks
Five scanners, one report.
Four well-known open-source scanners, plus our own rules for the customer data those scanners do not look for.
- gitleaks
Secrets
Keys, tokens and passwords in the current files and in the whole git history. A secret deleted from the files but still in the history stays high: every copy of the repository still has it.
Leaves the machine: Nothing
- built-in rules
Customer and personal data
Emails, phone numbers, ad account and campaign IDs, spend and revenue columns, IBANs, payment card numbers and Romanian personal numeric codes (CNP) left in docs, test data and exports. IBANs, cards and CNPs must pass their checksum; published test card numbers are ignored.
Leaves the machine: Nothing
- osv-scanner
Vulnerable dependencies
Packages with known vulnerabilities, the lowest version that fixes all of them, and, for npm packages, whether your code actually imports the package.
Leaves the machine: Package names and versions, sent to osv.dev
- Semgrep, free edition
Code flaws
Injection, unsafe input handling and similar flaws, with the free default ruleset.
Leaves the machine: Nothing; the rules are downloaded
- Trivy
Risky configuration
Dockerfile, Kubernetes, Terraform and CI settings that allow more than they should.
Leaves the machine: Nothing; the checks are downloaded
- md · sarif · json
One masked report
The five results land in one report. Secrets and personal values are masked, each finding has two severities with the reasons, and a “What ran” list shows any scanner that did not run, so a partial scan never looks clean.
// How it runs
Where your code already is, or with us under contract.
In your own CI
It runs as a step in your pipeline, for example a GitHub Actions job, on your runner. The reports stay with the
run; the SARIF file can go to GitHub code scanning. --fail-on high stops the job when a finding at
that level or above turns up.
On ANTHAURI machines, under contract
When the scan cannot run in your CI, we run it on our own machines, under a contract that says how your code is handled. Your code is not passed to anyone else.
What leaves the machine
- Your code
- Is not sent to any other service. There is no upload page, no hosted service and no account: this website cannot receive code.
- Findings and reports
- Are written as files on the machine that ran the scan, and go only to the people you choose.
- Package names and versions
- Are sent to osv.dev to look up known vulnerabilities. Nothing else leaves the machine.
- Downloads
- Before a scan, Semgrep downloads its rules and Trivy its checks.
// Reports
Where the problem is, never the value.
Reports go to engineers and managers, so they show the file and line of a secret or a phone number, not the secret or the number.
Three formats
- report.md
- for people
- report.sarif
- for GitHub code scanning and security dashboards
- report.json
- everything, to track findings between runs
How values appear (examples)
- j***@***.com
- Phone
- +** *** *** *19
- IBAN
- RO********************00
- Ad account
- act_***********23
Two severities, with the reasons
Each finding keeps the severity its tool gave it and gets a second one from the context, with notes that say why. For example:
- a dependency the code never imports, or one used only in development, goes down a level;
- anything in a test or example file goes down a level;
- customer data in a file that says it comes from production or a live test goes up to at least high;
- a secret removed from the files but still in the git history stays high.
A person confirms every critical and high finding before it is reported as real.
A scanner that is missing or fails is listed under “What ran”, and the run ends with exit code 3, so a partial scan never looks like a clean one.
// How we work
From scope to report in four steps.
-
Agree the scope
Which repositories, where the scan runs (your CI or our machines), and who receives the report.
-
Scan
One command runs the five scanners, git history included.
-
Review
A person confirms or rejects every critical and high finding before it is reported as real.
-
Report
You get the masked report, with the lowest safe version for each vulnerable dependency.
// Limits
What it does not do.
A clean report means these checks found nothing. It does not mean the code is secure.
Not covered in this version
- Data that flows from one file to another. The free edition of Semgrep looks at one file at a time.
- Business logic, and permissions between customer accounts.
- Personal data in the git history. Secrets in the history are covered.
- Licence checks.
- AI triage of findings. This version does not use AI.
- A ready-made GitHub Action that comments on pull requests. Today it runs as a step in your pipeline.
// Contact
Want your repositories scanned?
Tell us what you want scanned and where it should run. We reply within one business day.
Please do not email code, keys or customer data. We agree on a safe way to work first.
Phone
+40 769 369 710Monday to Friday, 9 a.m. to 5 p.m. Romania time. More about the company on anthauri.com.