Running five scanners gives you five reports and a lot of duplicate rows. Scanner Suite is the page where Safeguard says it merges them.
What it is
The page describes eleven scanners run against a codebase, with findings deduplicated and ranked by Safeguard's Eagle and Griffin models. The set covers package vulnerabilities, containers, filesystems, git repositories, infrastructure code, license detection, secrets, advisory matching, supply chain hygiene scoring, maintainer risk, imported static analysis findings, malicious package detection and code complexity as a triage signal.
Seven enrichment feeds are named: NVD, OSV, EPSS, CISA KEV, GitHub Advisory, VirusTotal and VulnCheck.
What comes out
- One deduplicated row per issue, with an evidence bundle.
- SBOMs in CycloneDX by default, with SPDX as an export option.
- An in-toto attestation pinned to the commit and image digest, regenerated on each build.
How to use it
- Scan a repository and open one issue.
- Read the evidence bundle to see which scanners agreed.
- Compare the reachability and exploitability notes with what you know of the code.
- Keep the attestation with the build record.
What to verify
The page shows headline figures about deduplication and coverage without a method behind them. Count the raw findings and the merged issues on your own repository instead of relying on the number.
Quick check
Which two models rank and reason over the merged findings?
Eagle ranks them and Griffin reasons about them.
