The following is a complete list of supported security controls:

Application Security

• Scan your code for vulnerabilities (SAST)
• Scan code for hard-coded secrets
• Scan your code dependencies for vulnerabilities (SCA)
• Software Bill of Materials (SBOM)

Cloud Security

• Scan your infrastructure-as-code (IaC) for misconfigurations
• Scan infrastructure for runtime misconfigurations
• Scan your Dockerfiles for vulnerabilities
• Verify that the users of your AWS accounts have enabled MFA
• Scan Kubernetes configuration files
• Import AWS Security Hub Findings

Web Application Security

• Scan your web application for vulnerabilities (DAST)
• Scan your API for vulnerabilities (DAST)

CI/CD Security

• Verify that MFA for your GitHub organization is enabled
• Verify that Github Branch Protection is properly configured
• Detect GitHub misconfigurations