Stop triaging vulnerabilities your code cannot reach.
Ferralon Assay is a free, open-source GitHub Action that analyzes your build and tells you which advisory findings are out of scope, which are worth investigating, and which need more evidence.
Run it in your own CI, on your own runner. Your source code and results stay with you.
A package match is not an engineering answer.
Most vulnerability scanners stop at the dependency version. Ferralon Assay continues into the code—mapping vulnerable symbols and tracing the paths from your application to the code an advisory describes.
That turns a package-level alert into a sharper engineering question: does this vulnerable code matter in this build?
Turn a vulnerability finding into an engineering next step.
- DisqualifiedResolved vulnerability is not found in this code base.
- Not reachableVulnerable code is not on a path the application invokes.
- Reachable candidateCode can reach the vulnerable function; prove it.
- Not assessedMore evidence is needed before a conclusion can be drawn.
Ferralon Assay supports Go, Java, JavaScript, Python, and .NET.
Ferralon continues to expand the reachability intelligence available to engineering teams.
Evidence before escalation.
Assay turns dependency alerts into evidence-backed next steps. It separates findings your code can reach from findings that do not apply, so teams can focus their attention where it matters.
It reasons about your code statically and never executes it, so it tells you what your code can reach and stays precise about what it has not yet concluded.
Every run emits report.json, SARIF, OpenVEX, and HTML, plus a comment on the pull request — so the verdicts land in the tools your team already uses.
One pinned step in your CI.
Paste this into .github/workflows/ferralon-assay.yml. It pins the Action to a release commit — not a moving tag — so what runs is exactly what you audited.
# .github/workflows/ferralon-assay.yml
name: Ferralon Assay
on:
pull_request:
permissions:
contents: read # check out your repository
pull-requests: write # leave the scan's comment on the PR
security-events: write # file the SARIF in GitHub code scanning
jobs:
assay:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- run: go build ./... # resolve the module graph the scan reads
- uses: ferralon-ai/ferralon-assay@67ce1b77c0ade791167a13ee83d74df11e4d4e1d # v0.1.8
with:
mode: baseline # scan the whole PR (the default)
issue: "false" # skip the repo-wide dashboard Issue
runs-url: "" # the scan stays on your runner — nothing is sent to us
Three permissions, and only these three: contents: read to check out your code, pull-requests: write to leave the PR comment, and security-events: write to file the SARIF. Nothing broader. runs-url: "" means no repository data or scan results are sent to us.
Apache-2.0 for the code. CC BY 4.0 for the data.
Ferralon Assay is Apache-2.0 — the Action and the reachability engine live in one open-source repository, so use it, fork it, and ship it. The vulnerability data is CC BY 4.0, sourced one advisory at a time so we can pass it on to you that way, with a build check that keeps it honest.