Security sensors
Understand supported scanners, execution boundaries, rollout states, and cross-tool finding deduplication.
Security sensors
Hyperoru uses open-source security tools as evidence producers. It does not combine every tool into one privileged scanner process, and catalogue presence never activates a tool automatically.
Execution tiers
| Tier | Tools | State | Boundary |
|---|---|---|---|
| Core mandatory repository | Trivy, Semgrep, Gitleaks, Checkov, Syft | enabled and required | disposable, network-isolated repository runner |
| Extended mandatory repository | OSV-Scanner, Grype, Conftest, zizmor, Hadolint, OWASP Dependency-Check | enabled and required after trusted-image publication | same offline runner with baked data and policy |
| Cloud and cluster | Prowler, Kubescape, kube-bench | connector planned | scoped cloud identity or customer-operated cluster collector |
| Active testing | OWASP ZAP, Nuclei | execution service planned | allowlisted target and explicit authorization |
| Runtime | Falco | evidence adapter planned | customer-operated runtime collector |
All eleven repository sensors require an immutable image digest. A control worker fails startup if one is missing, and a scanner that does not complete during an audit creates a visible coverage gap. The trusted-image workflow is the only supported path for publishing those images.
One issue, all of its sources
Hyperoru canonicalizes shared CVE and GHSA aliases across dependency scanners. If Trivy, OSV-Scanner, and Grype observe the same advisory in different manifests, the workspace shows one finding with multiple source tools and evidence records. It does not discard the corroboration.
Scanner-specific rules remain separate unless they share a reviewed deterministic identity. Title similarity and model judgement are not sufficient to merge findings.
Each canonical finding retains:
- the primary presentation and strongest risk representation;
- every contributing tool, version, and upstream rule identifier;
- every unique source location and scanner-run evidence record;
- the audit, commit, first-seen, and last-seen history;
- coverage gaps for sensors that did not complete.
Permission is part of the integration
Repository scanners inspect an inert snapshot. Cloud and cluster tools need infrastructure context. DAST tools send network traffic. Runtime tools observe live systems. Those are different authority classes, so Hyperoru models them as scoped connectors or evidence feeds instead of granting the repository runner ambient credentials, cluster access, target access, or host privileges.
See the public control and licence catalogue for current versions and rollout states.