Riscly docs

Guides

Scanning & the architecture map

A scan is what turns connected systems into an architecture graph and a prioritized risk list. This page explains what runs, what the map shows, and how confidence works.

What a scan runs

  • Architecture inference — components (frontend, APIs, databases, queues, third-party services) and the flows between them.
  • SAST — dataflow-based static analysis of your source, not just regex matching.
  • SCA & SBOM — transitive dependency analysis and a software bill of materials, matched against known vulnerabilities (OSV.dev).
  • Secret detection — verified secret findings; detected secrets are masked before storage.

Scans are asynchronous

Starting a scan returns immediately with a status. When a job queue is configured, the scan runs in the background — so poll the scan list until the status is succeeded or failed rather than assuming results are ready.

const scan = await riscly(`/projects/${projectId}/scans`, {
  method: "POST",
  body: "{}",
}).then((r) => r.json());

let done;
do {
  await new Promise((r) => setTimeout(r, 2000));
  const scans = await riscly(`/projects/${projectId}/scans`).then((r) => r.json());
  done = scans.find((s) => s.id === scan.id);
} while (done.status !== "succeeded" && done.status !== "failed");

Reading the architecture map

Nodes are components; edges are the data and control flows between them. Riscly merges verified nodes (from a connected collector, e.g. Vercel or Supabase) with inferred nodes (deduced from your code and dependencies) so that connecting a service after a code-only scan does not create duplicates — and nothing is dropped.

Manual corrections persist

Edits you make to the map are stored as an overlay on top of the auto-detected graph, so they survive future scans. See architecture overlay in the API reference.

Confidence levels

Every finding is labelled so you know how much certainty sits behind it:

  • verified — confirmed from a connected source or a reproduced signal.
  • high — strong evidence from analysis, low false-positive rate.
  • heuristic — inferred; worth checking before acting.

Deep AI analysis

Optionally run a deeper AI pass over the repo's source files; the additional findings are merged into the scan. This requires AI to be enabled on the server.

curl -X POST \
  https://api.riscly.com/api/projects/PROJECT_ID/code/deep-scan \
  -H "Authorization: Bearer $RISCLY_TOKEN" \
  -H "x-org-id: $RISCLY_ORG_ID"
PreviousConnect a repositoryNext Risks & one-click fixes