Frequently Asked Questions

General

What is Cerberus?

Cerberus is a security-orchestration platform for GitHub repositories and local directories. It combines a 59-check native catalog, CLI ALIGNMENT analysis, and optional normalized findings from five open-source security tools.

Who is Cerberus for?

Solo founders, indie hackers, seed-stage startups, development agencies, and any team that ships AI-assisted code and wants a fast first pass before a real security review.

Is Cerberus a replacement for a penetration test?

No. Cerberus is a static pattern-matching scanner. It catches common, well-known mistakes in seconds; it does not replace a human-driven review of business logic, authorization edge cases, or anything requiring runtime analysis.

How long does a scan take?

Typically seconds to a couple of minutes, bounded by the scan budget (≤2,000 files fetched, ≤2 MB per file, 120-second wall clock for the web app).

Agents & Checks

What are the nine agents?

SENTINEL (code analysis), GATEKEEPER (access control), VAULT (data security), CONDUIT (network & API), WATCHTOWER (application config), LIBRARIAN (dependencies), SHIELD (client security), AUDITOR (logging & monitoring), and ARCHITECT (infrastructure).

How many checks does Cerberus run?

59 native checks, defined in checks.json — the source of truth for web and CLI native scoring. ALIGNMENT and feeder rules are additive and are not counted in those 59. Browse the native list on the Check Catalog page.

How do you avoid false positives?

Each check honors placeholder filtering (so your_api_key_here or process.env.X don't trigger a secrets check), test-path exclusion, and a hit cap per check so one noisy file doesn't dominate the score. The ship gate for the catalog is a ≤10% false-positive rate on manual review; noisy checks get tightened, not shipped.

Do checks fix issues automatically?

No. Findings include a concrete remediation, and many include a copyable suggested-fix code block, but nothing is applied automatically.

Scanner & Reports

Can the web app scan any website?

No. Browsers cannot fetch arbitrary origins due to CORS, so the web app only scans public GitHub repositories. To scan a local directory, a private repo, or anything else, use the CLI (examine.py).

What files does a scan read?

Source, config, and infra files matching checks.json's source_globs (most common backend/frontend languages, JSON/YAML/TOML/env config, Dockerfiles, Terraform). It never scans node_modules, vendor, build output, lockfiles, or minified bundles — see global_exclude in checks.json.

Where is the report saved?

The CLI writes wherever you point --json, --html, or --sarif. The web app caches reports in the browser's localStorage and lets you download JSON/HTML or copy a Markdown summary.

Can I run Cerberus in CI/CD or GitHub Actions?

Yes. You can add Cerberus to any GitHub repository in minutes by adding .github/workflows/cerberus.yml. It runs standard Python 3.9+ without external dependencies, gates PRs via --fail-under <score>, publishes SARIF alerts directly to GitHub Code Scanning, and uploads standalone HTML and JSON report artifacts. See the Quickstart GitHub Action guide or the CLI Scanner reference for complete workflow examples.

What happens when a feeder is not installed?

The result is unavailable, not a crash. It is a warning by default and becomes a blocker/non-zero exit only when --strict-feeders is requested. Repositories without applicable input receive not_applicable.

What is a good score?

90–100 is an A. 80–89 is a B. A clean, well-run repository should be able to score in the 90s — if a healthy reference repo can't break 80, that's a signal the catalog needs tightening, not that the repo is unusually risky.

Security & Privacy

Do you store my source code?

CLI scans run entirely on your machine and never upload code anywhere. The web app fetches file contents directly from GitHub into your browser and evaluates them client-side — source is not sent to any Cerberus-operated server.

Does Cerberus have internet access to my code?

The web app calls the public GitHub API and the raw.githubusercontent.com CDN directly from your browser. There is no intermediary server, no sandboxed execution environment, and no CVE-database network lookups — dependency checks are static regex matches against version ranges recorded in checks.json.

Is a report private?

Web-app reports are cached only in your own browser's localStorage. CLI reports are written to whatever local path you specify.

How do the web app's AI features work?

The optional AI analyst and report console use Pollinations through its OpenAI-compatible API. Choose Sign in with Pollinations in the AI analyst panel to approve a short device sign-in at enter.pollinations.ai, or provide your own Pollinations API key. The resulting token stays in this browser tab's session storage and is sent only to Pollinations; the deterministic repository scan remains independent of AI.

Support

Where can I get help?

Open an issue in the repository or reach out to the team.

Can I request a new check?

Yes. Checks live in checks.json; if you encounter a vulnerability class Cerberus misses, let us know and we'll add a check to the appropriate agent — see the README for how the catalog is structured.