Methodology

Every scan passes through seven stages. Each stage exists to reduce noise and increase signal. Raw agent output is never shown directly to users -- it passes through consensus scoring, false positive filtering, cascade analysis, architectural collapse, and AI refinement before a single finding reaches your report.

Each agent is a named, specialized reviewer with a distinct attack perspective. Security agents look for injection vectors, authentication bypasses, and privilege escalation. Structural agents look for coupling, dead code, and architectural smells. Specialty agents cover i18n, accessibility, cloud cost, real-time safety, compliance, and more.

Agents operate independently -- they do not see each other's findings. This eliminates confirmation bias. When three agents from different categories flag the same code path, that convergence is a much stronger signal than a single agent's opinion.

A single AI reviewer has blind spots determined by its training data and prompt. By deploying dozens of agents with different specializations, attack angles, and severity thresholds, ShipItClean achieves coverage that no single-pass review can match. The consensus stage then separates signal from noise.

Agents run at different quality tiers, from budget (fast, lightweight) to Diamond (frontier reasoning). Users control the tier mix per scan. Higher tiers catch subtler issues -- business logic flaws, race conditions, multi-file attack chains -- that cheaper models miss.

After all agents complete, the consensus engine cross-references their findings. Findings that appear from multiple independent agents are scored higher. Isolated findings from a single agent are flagged for additional scrutiny.

The consensus model weights agent tier (Diamond findings carry more weight than Bronze), category relevance (a security agent's finding about SQL injection carries more weight than a structural agent's), and specificity (findings with exact file/line references score higher than vague concerns).

AI code reviews hallucinate. Every tool that uses LLMs to analyze code produces false positives. ShipItClean's FP filter is a dedicated post-scan agent that reviews each finding with access to the actual source code and the finding context.

The filter classifies each finding as: Real Threat (confirmed, actionable), Context-Dependent (may be intentional, needs human judgment), or False Positive (hallucinated, inapplicable, or already mitigated). Only Real Threat findings with confirmed IDs drive the report's confirmed count.

The Domino scanner is a hidden post-scan agent that traces fix cascades. When the LLM refinement stage suggests a fix for finding A, the Domino scanner checks: does this fix break file B? Does it invalidate finding C? Does it require changes in module D?

This prevents the common failure mode of AI-suggested fixes that resolve one issue while introducing three new ones. The fix workflow includes Domino-traced dependencies so developers know the full blast radius before making changes.

When 12 agents each flag a different line in the same module for similar issues, the problem is not 12 separate bugs -- it is one architectural flaw. The architectural scanner collapses clusters of related line-level findings into a single root cause with a structural fix recommendation.

This dramatically reduces noise in large scans. A 400-finding raw output might collapse to 50 actionable items, each with a clear scope and fix strategy.

Every scan produces a ShipItClean Score from 0 to 1000. The formula is published and deterministic:

Where B = 100 (baseline constant) and P = Critical × 10 + High × 3 + Medium × 1 + Low × 0.25

Tiers: Excellent (900+) · Strong (750-899) · Progressing (550-749) · Needs Attention (350-549) · Critical Risk (<350)

Scores are comparable across projects and over time. Track your score across releases to measure security posture improvement. View the Public Threat Index to see how open-source projects score.

Results are available in multiple formats for different workflows: