AI-powered security analysis platform with modular scanning architecture

A system comprising:

• at least one hardware processor;
• and
• at least one non-transitory memory storing instructions, which, when executed by the at least one hardware processor, cause the system to perform operations including:
• scanning a codebase stored in a software repository to generate a scan snapshot of the software repository;
• analyzing, using one or more code analyzers, the scan snapshot across a corresponding one or more security domains;
• identifying, using one or more large language models (LLMs), a security vulnerability associated with the scan snapshot, wherein said identifying is based on a context of the software repository determined using the scan snapshot, and wherein the security vulnerability is associated with one of the one or more security domains;
• determining, using a call graph, one or more components of the codebase through which the security vulnerability propagates, wherein the call graph is generated based on function calls in the codebase;
• storing a timestamped record associated with the scan snapshot, wherein the timestamped record indicates the security vulnerability and the one or more components;
• comparing the timestamped record to a prior timestamped record associated with a prior scan snapshot of the software repository to determine a change in a status of the security vulnerability;
• and
• sending a report indicating the change in the status of the security vulnerability to a computer device.

A method comprising:

• scanning a codebase stored in a software repository to generate a scan snapshot of the software repository;
• accessing a timestamped record associated with a prior scan snapshot of the software repository, wherein the timestamped record indicates a security vulnerability associated with the prior scan snapshot;
• analyzing, using one or more code analyzers, the scan snapshot across a corresponding one or more security domains;
• determining, using one or more large language models (LLMs), that the security vulnerability is absent from the scan snapshot, wherein said determining is based on (i) said analyzing and (ii) a context of the software repository determined using the scan snapshot;
• determining a change in a status of the security vulnerability based on (i) the timestamped record indicating the security vulnerability associated with the prior scan snapshot and (ii) determining that the security vulnerability is absent from the scan snapshot;
• generating, based on the change in the status, a report indicating that the security vulnerability is remediated;
• and
• sending the report indicating that the security vulnerability is remediated to a computer device.