Interactive demo

Walk the SiteShadow scanner pipeline.

Pick an entry point (VS Code, Cursor, the authenticated CLI, CI/SARIF, or an API client) and step through the five static analysis engines that produce SiteShadow's evidence. Same SAST core for every surface; the output format is what changes.

This is the same scanner-pipeline view shown on the homepage. For the underlying evidence, see coverage, proofs, and the detection credibility matrix.

Scanner pipeline

One scanner, four paths

VS Code and Cursor, the authenticated CLI, CI/SARIF jobs, and API clients all feed the same SiteShadow SAST core. The output changes by surface; the evidence model does not.

Editor scan ready: inline diagnostics will use the same shared SAST core.

Entry points

Shared SAST core

Static evidence pipeline

Single-file scans run the base rules plus deeper analysis. Project scans add cross-file, dependency, and workspace context before findings are merged and deduplicated.

VS Code / Cursor request active file, workspace context, editor diagnostics

Engine 01 2,011 checks

Regex rules

Loads static rule patterns, preserves line offsets, honors ignore directives, and returns direct evidence for secrets, unsafe imports, risky literals, and known weak primitives.

const token = "sk_live_redacted";
// siteshadow:ignore-next-line
const fixture = "fake_test_secret";

Rule ID, severity, source range, and message
Comment-aware matching without line drift
Evidence suitable for editor and CI output

Outputs

Editor feedback Line-level diagnostics and fix prompts

SARIF / JSON CI upload, PR comments, machine-readable gates

Evidence pages Coverage, proofs, credibility matrix, audit artifacts

SAST context only: findings are static evidence for review, not proof of runtime exploitability.

See the evidence behind the pipeline.

Walk specific proofs that show the SAST core doing real work: a multi-hop SQL injection traced across helper functions, and how data-flow context separates real findings from sanitized noise.

Read the multi-hop SQLi proof See how data flow reduces noise

Create a free account for access

SiteShadow is an independent project built by Michael and Mirian. Mirian is Hispanic and a member of a minority community. Michael is a 100% disabled veteran. Create a free SiteShadow account with Google sign-in using a compatible verified email. After accepting the Terms, choose an individual or organization workspace and receive a permanent SiteShadow API key. The CLI and install surfaces follow their release-readiness controls. Contact support for help with your extension, API key, or organization setup.

Create a free account Browse rule library