Argus, Supply Chain Security
Argus scans your repositories for vulnerable dependencies, hardcoded secrets, insecure code and misconfigured infrastructure, reviews every pull request, and can block a merge until the findings are resolved.
Argus is the supply-chain security module of the NexusVoid platform. It scans your repositories, reviews your pull requests, and gives you an inventory of what you actually ship.
What Argus does
Find what is really there
SAST, dependency CVEs, hardcoded secrets and IaC misconfiguration, with reachability analysis so a CVE in code you never call is ranked below one you do.
Stop it before it merges
Argus reviews every pull request and posts a commit status. You decide whether that status blocks the merge.
Know your supply chain
Dependency inventory, SBOM/CBOM/QBOM/HBOM exports, the API routes your code exposes, and the third-party services it calls.
Fix it, not just file it
Every finding carries a remediation path, and an AI agent can open the fix as a pull request for you to review.
Reading your finding count
A project's total is split by where each finding came from, because the four kinds are four different jobs and only one of them is a code change you make.
| Bucket | What it is | How you fix it |
|---|---|---|
| Your code | First-party source your team wrote | A pull request |
| Dependencies | CVEs in packages you install | Upgrade the package |
| Container image | CVEs in OS packages inside a base image | Rebuild on a newer base |
| Infrastructure | Helm, Kubernetes, Terraform and Dockerfile misconfigurations | Change the manifest |
The dashboard leads with the first bucket. The others keep their own totals and are never folded into it.
Two figures sit alongside the code count. Distinct problems collapses repeated hits of one rule on one file, because a rule firing on four lines is one thing to fix rather than four. In test files tells you how many landed in tests, which is worth knowing because a test asserting on a dangerous pattern contains that pattern.
On a repository with a Dockerfile, container CVEs routinely outnumber code findings several times over. That is normal and it is why the split exists. Rebuilding on a current base image usually clears them in one change.
Start here
Quick Start
Connect a repository and run your first scan.
Concepts
Severity vs priority, reachability, credits.
API Reference
The GraphQL endpoint and its operations.
What Argus will not tell you
Argus reports what it can prove and says so when it cannot. Three examples you will meet:
- API endpoints are labelled
Authenticated,Open / no auth, orNot determined, the third means auth machinery exists but could not be tied to that route. It is not a finding. - Compliance controls Argus has no check for are marked not assessed, never "pass". Absence of evidence is not evidence of compliance.
- A failed scan does not resolve your backlog. If a scanner could not run, its findings stay open and the run is reported as failed.
This is deliberate. A security tool that guesses confidently is worse than one that admits a gap.