Repository Security
What a repository security assessment actually checks beyond an automated scan — collaborator access, branch protection, dependency provenance, secret detection mechanics, and the ownership practices that keep a repository from becoming an orphaned liability.
CWE-798Use of Hard-coded Credentials — the primary weakness class secret detection targetsRelated Resources
Repository Security Scanner
Scan GitHub and GitLab repositories for hardcoded secrets, sensitive files, SAST vulnerabilities, and dependency CVEs — OWASP-mapped, OSV-backed.
Framework Coverage
See how Strata Security maps findings to OWASP Mobile Top 10, ASVS, CWE, CVSS v3.1, MITRE ATT&CK Mobile, and NIST SSDF — full coverage matrix and mapping.
Go Deeper in the Reference Database
CWE-798: Use of Hard-coded Credentials
A weakness where software contains a hardcoded credential (password, key, or token) used for authentication or encryption.
CWE-1104: Use of Unmaintained Third-Party Components
A weakness from depending on a third-party component that is no longer actively maintained or supported.
T1476: Deliver Malicious App via Other Means
An adversary technique for distributing a malicious or trojanized application outside of an authorized app store.
Other Categories
Mobile Application Security
Static and dynamic analysis of Android and iOS applications, and the OWASP Mobile Top 10 framework findings map to.
CI/CD Security
Pipeline trust boundaries, branch protection, artifact integrity, and deployment gating for GitHub Actions and GitLab CI.
Secure SDLC
Treating security requirements as a design constraint from the start, not a review gate at the end.
Vulnerability Management
Turning raw findings into a prioritized, trackable backlog — beyond what a severity score alone can tell you.
Reverse Engineering
Manual analysis of compiled binaries — the toolchain and reasoning static analysis automates a subset of.
Software Supply Chain
Dependency provenance, build artifact integrity, and the trust boundaries every third-party package introduces.
Engineering Leadership
Making application security legible to the people who manage teams and answer for organizational risk.