Stop triaging vulnerabilities your code cannot reach.
Ferralon Assay is a free, publicly available GitHub Action that analyzes your build and tells you which advisory findings are out of scope, which are worth investigating, and which need more evidence.
Run it in your own CI, on your own runner. Your source code and results stay with you.
A package match is not an engineering answer.
Most vulnerability scanners stop at the dependency version. Ferralon Assay continues into the code—mapping vulnerable symbols and tracing the paths from your application to the code an advisory describes.
That turns a package-level alert into a sharper engineering question: does this vulnerable code matter in this build?
Turn a vulnerability finding into an engineering next step.
- DisqualifiedResolved vulnerability is not found in this code base.
- Not reachableVulnerable code is not on a path the application invokes.
- Reachable candidateCode can reach the vulnerable function; prove it.
- Not assessedMore evidence is needed before a conclusion can be drawn.
Ferralon Assay supports Go, Java, JavaScript, Python, and .NET.
Ferralon continues to expand the reachability intelligence available to engineering teams.
Evidence before escalation.
Assay turns dependency alerts into evidence-backed next steps. It separates findings your code can reach from findings that do not apply, so teams can focus their attention where it matters.
It reasons about your code statically and never executes it, so it tells you what your code can reach and stays precise about what it has not yet concluded.
Every run emits report.json, SARIF, OpenVEX, and HTML, plus a comment on the pull request — so the verdicts land in the tools your team already uses.
One pinned step in your CI.
Paste this into .github/workflows/ferralon-assay.yml. It pins the Action to a release commit — not a moving tag — so what runs is exactly what you audited.
# .github/workflows/ferralon-assay.yml
name: Ferralon Assay
on:
pull_request:
permissions:
contents: read # check out your repository
pull-requests: write # leave the scan's comment on the PR
security-events: write # file the SARIF in GitHub code scanning
jobs:
assay:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version-file: go.mod
- run: go build ./... # resolve the module graph the scan reads
- uses: ferralon-ai/ferralon-assay@67ce1b77c0ade791167a13ee83d74df11e4d4e1d # v0.1.8
with:
mode: baseline # scan the whole PR (the default)
issue: "false" # skip the repo-wide dashboard Issue
runs-url: "" # the scan stays on your runner — nothing is sent to us
Three permissions, and only these three: contents: read to check out your code, pull-requests: write to leave the PR comment, and security-events: write to file the SARIF. Nothing broader. runs-url: "" means no repository data or scan results are sent to us.
Public source. Free to use.
The Action and the reachability engine live in one public repository, so you can read it, run it, and build on it — free. The vulnerability data is published the same way, sourced one advisory at a time so we can pass it on to you that way, with a build check that keeps it honest.