The scanners

22 scanners, 3 profiles, one readable PDF

Enabling everything produces a 200-page report buried in style warnings that hide the real vulnerabilities. Hykaro groups scanners into three profiles you activate per project.

Security: always on

The core, non-disableable, on all tiers.

• SAST: semgrep (OWASP, CWE Top 25, AI-coded patterns)
• Secrets: gitleaks, trufflehog
• Dependencies: npm-audit, pip-audit, composer audit, cargo audit
• IaC & container: trivy, checkov, hadolint
• Web: eslint-plugin-security, dangerouslySetInnerHTML detection

Accessibility: included on paid tiers

RGAA 4.1 + WCAG 2.1 AA + EAA coverage. pa11y, lighthouse, custom WCAG rules. Generates a numeric score, screen by screen, with annotated screenshots. A strong selling point in markets where accessibility compliance deadlines are approaching.

Quality: opt-in

phpstan, eslint, tsc, knip, madge, depcheck. Capped at low severity so it never pollutes your security KPIs. Enable it when you want a code-quality audit beyond security.

Curation, not accumulation

The scanners are OSS. The moat is curation: false positives filtered out, automatic stack cookbooks, findings organized to be read, not just generated.

Run a scan on your stack →