Security Scanner Bundles

Plexicus ships 15 security scanner bundles plus connectors for external enterprise tools. This guide explains what each bundle detects, how to configure it, and how severity levels behave across bundles.

Scanner Bundles Overview

Each bundle packages one or more specialized detection engines behind a single, product-managed capability. Select which bundles to enable when creating or updating an application.

Bundle	Detects	Plan
plexicus-sast	Code vulnerabilities, injection flaws, unsafe patterns — with dataflow tracing and Python-specialized checks	Starter+
plexicus-sca	Vulnerable dependencies across all major package managers, cross-referenced against CVE databases (NVD, GitHub Security Advisory)	Starter+
plexicus-secrets	Hardcoded credentials, API keys, and tokens — in the working tree and across Git history, with live verification against issuing services	Starter+
plexicus-container	Misconfigurations in Dockerfiles, Kubernetes manifests, and config files (CIS benchmarks)	Scale+
plexicus-iac	Infrastructure-as-Code policy violations across Terraform, CloudFormation, Kubernetes, Helm, Ansible, ARM	Scale+
plexicus-cicd	CI/CD pipeline misconfigurations (GitHub Actions, GitLab CI, Azure Pipelines)	Scale+
plexicus-cloud	Cloud account misconfigurations on AWS, Azure, GCP — permissive IAM, unencrypted storage, exposed services	Scale+
plexicus-dast	Dynamic testing of running applications: HTTP misconfigurations, default credentials, known CVEs	Scale+
plexicus-pentest	AI-powered autonomous penetration testing: feature exploration, input fuzzing, auth bypasses, business-logic flaws	Scale+
plexicus-sbom	Software Bill of Materials (SBOM) generation in CycloneDX/SPDX	Scale+
plexicus-aibom	AI Model Bill of Materials (AIBOM): ML models, training datasets, model cards	Scale+
plexicus-cbom	Cryptographic Bill of Materials (CBOM): algorithms, key sizes, quantum-readiness (NIST 2030/2035)	Scale+
plexicus-license	License compliance: copyleft, proprietary, or unknown licenses across dependencies	Scale+
plexicus-scm	Supply-chain posture and SLSA compliance: signed commits, artifact provenance, build hardening	Scale+
plexicus-registry	Container registry image scanning: vulnerable base images at pull time	Scale+

External Tool Integrations

Plexicus ingests results from external enterprise security tools alongside its own bundles:

Tool	Purpose	Integration
Black Duck (Synopsys)	Commercial SCA & license analysis	API ingestion
Checkmarx (Checkmarx One)	SAST + IaC	API ingestion
Fortify (OpenText)	SAST + DAST	API ingestion
Prowler	AWS/Azure/GCP compliance scanning (CIS, NIST, PCI DSS)	Direct execution
CodeQL	GitHub code-scanning alert ingestion	GitHub webhook ingestion
Semgrep	Semgrep AppSec Platform findings	API token

Parameter Configuration

Canonical Parameters

Three parameters are available on most bundles and are translated automatically to each engine's native options:

• Severity · Minimum severity level to report (info, low, medium, high, critical)
• Exclude Paths · Filesystem patterns to skip (e.g., node_modules/, test/)
• Severity Filter · Post-scan filtering for engines without a native severity option

Advanced Bundle Parameters

Bundles expose additional parameters for fine-grained control:

plexicus-sast:

• config · Custom rule configuration
• baseline_commit · Differential scanning (only new issues since a commit)
• dataflow_traces · Enable taint tracking
• exclude_rule · Disable specific rules
• max_lines_per_finding, timeout, max_target_bytes, exclude_minified_files, strict · Output and performance tuning
• Python-specific: tests / skips (check IDs to run or skip), confidence_level, ignore_nosec

plexicus-sca:

• fail_on · Exit with an error code when vulnerabilities are found
• only_fixed / only_notfixed · Filter to fixed/unfixed CVEs
• by_cve · Group results by CVE instead of package
• scope · Container layer scope (squashed vs. all-layers)
• distro · OS distribution hint (Alpine, Debian, …)

plexicus-container / plexicus-registry / plexicus-license:

• ignore_unfixed · Skip vulnerabilities without an available patch
• include_dev_deps · Include development dependencies
• pkg_types · Package-type filter (jar, wheel, npm, …)
• offline_scan · Run without internet access
• detection_priority · Detection algorithm selection

plexicus-iac / plexicus-cicd:

• check · Run only specific policy checks (e.g., CKV_TF_1, CKV_AWS_8)
• skip_check · Disable specific checks
• skip_framework · Skip entire frameworks (e.g., terraform, kubernetes)
• soft_fail · Report violations without failing the scan

plexicus-dast:

• templates / tags / exclude_tags · Select probe templates
• type · Limit to a vulnerability class (dns, http, network, ssl)
• timeout, retries, max_redirects · Network tuning
• passive · Run only non-intrusive checks

plexicus-secrets:

• redact · Redact secret values in output
• no_verification · Skip live verification against issuing services
• include_detectors / exclude_detectors · Detector selection

plexicus-sbom:

• enrich · Package enrichment (all, golang, java, javascript)
• scope · Image layer handling (squashed, all-layers, deep-squashed)

plexicus-pentest:

• custom_prompt · Custom AI instructions (max 500 chars, sanitized)

Severity Behavior per Bundle

info

Not every engine has native severity filtering. Where an engine lacks it, Plexicus collects all findings first and filters server-side — nothing is missed during collection, at the cost of slightly longer scans.

Bundle	Severity handling
plexicus-sast	Native. Canonical levels map onto each engine's own scale (three-level and four-level engines); critical maps to the engine's highest level.
plexicus-container / registry / license	Native five-level scale — canonical levels map 1:1 (with info treated as the lowest level).
plexicus-dast	Native five-level scale — 1:1 mapping.
plexicus-sca	Post-scan filtering (use fail_on for exit-code gating).
plexicus-secrets	Post-scan filtering.
plexicus-sbom / aibom / cbom	Not applicable — BOM bundles catalog components rather than grade findings.
plexicus-iac / cicd	Config-based check selection instead of severity flags.
plexicus-pentest	Reports all findings; triage in the dashboard.

What this means: if you set severity: "high" on a bundle with post-scan filtering, Plexicus collects everything and filters to high/critical in the dashboard.

Exclude Paths Support

Bundle	Exclude paths
plexicus-sast	✓ (glob patterns, e.g. node_modules/, *.test.js)
plexicus-sca	✓
plexicus-container / license	✓ (directory skips, e.g. test/, .git/)
plexicus-iac / cicd	✓
plexicus-sbom	✓
plexicus-secrets	✗ (scope via repository structure)
plexicus-dast / pentest	✗ (target-based, not path-based)
plexicus-cloud / scm / registry / aibom / cbom	✗

Per-Bundle Parameter Support

Bundle	Severity	Exclude Paths	Advanced Params
plexicus-sast	✓	✓	✓
plexicus-sca	✗	✓	✓
plexicus-secrets	✗	✗	✓
plexicus-container	✓	✓	✓
plexicus-iac	✗	✓	✓
plexicus-cicd	✗	✓	✓
plexicus-cloud	✗	✗	—
plexicus-dast	✓	✗	✓
plexicus-pentest	✗	✗	✓
plexicus-sbom	✗	✓	✓
plexicus-aibom	✗	✗	—
plexicus-cbom	✗	✗	—
plexicus-license	✗	✓	—
plexicus-scm	✗	✗	—
plexicus-registry	✗	✗	—

Bundle Selection Guide

For Python Projects

Enable plexicus-sast + plexicus-sca + plexicus-secrets. If your code handles cryptography: add plexicus-cbom.

For Node.js / JavaScript

Enable plexicus-sast + plexicus-sca + plexicus-secrets. For monorepos with Kubernetes manifests: add plexicus-iac.

For Infrastructure-as-Code (Terraform, CloudFormation, Helm)

Enable plexicus-iac, plus plexicus-cloud if an AWS/Azure/GCP account is connected.

For Docker / Container Images

Enable plexicus-container, plus plexicus-registry for published images and plexicus-license for license compliance.

For CI/CD Pipelines (GitHub Actions, GitLab CI, etc.)

Enable plexicus-cicd to audit workflow definitions for security misconfigurations.

For APIs & Web Applications

Enable plexicus-dast to probe running applications. For deeper autonomous testing: add plexicus-pentest.

For Bill of Materials & Compliance

Enable plexicus-sbom for dependency inventory. Add plexicus-cbom for cryptographic assets, plexicus-aibom for ML models, plexicus-license for license risk, and plexicus-scm for supply-chain posture.

See Also

• xBOM (Bill of Materials) — Manage SBOM, CBOM, AIBOM exports and VEX statements
• Compliance Dashboard — Map findings to compliance frameworks
• Findings Remediation — Track and fix scanner discoveries