Documentation
Stellar Lock in 10 minutes.
An honest, technical guide to how Stellar Lock audits code, what it catches, and where to plug it into your workflow.
Quickstart
- Sign in with Google or email at /auth.
- Open the Vulnerability Core.
- Paste code, drag in files, or upload a
.zip. - Pick an engine — Speed Scan for fast triage or Deep Reasoning for complex flows.
- Click Run audit. Findings stream in real-time with line refs and patch suggestions.
- Export as JSON or SARIF, or revisit later from History.
Scan engines
Stellar Lock ships two reasoning engines tuned for different jobs.
Speed Scan
single-passSingle-pass triage. Best for snippets, configs, single files, and CI gates where latency matters. Catches the obvious — injection, hardcoded secrets, weak crypto, misconfigured RBAC.
Deep Reasoning
multi-stepChains analysis across files, tracks data flow between functions, and reasons about business-logic abuse. Recommended for smart contracts, auth flows, and anything where exploit chains span multiple files.
Pre-flight checks
Before any payload leaves your browser, the Pre-flight panel runs two deterministic checks locally:
- Secret detection — regex + entropy scoring for AWS GitHub OpenAI Anthropic Stripe Slack Google JWT RSA / SSH keys and generic
.envvalues. - Dependency CVEs — parses
package.json,requirements.txt,Cargo.toml,go.mod,Gemfile.lock— then queries OSV.dev for known vulnerabilities.
Reading findings
Every finding has the same shape:
- Threat level — Critical · High · Medium · Low · Safe (color-coded).
- Title + category — e.g. SQL injection via unsanitized input, mapped to OWASP / CWE.
- Location — file path and line number, clickable to jump in the editor.
- Explanation — why it's a vulnerability, what an attacker would do with it.
- Patch — a concrete code suggestion, copyable in one click.
Use the Compare view (/compare) to diff two scans side-by-side and see which findings were resolved.
Exporting SARIF / JSON
Every scan exports as SARIF 2.1.0 — the industry standard. SARIF imports cleanly into:
- GitHub Code Scanning (upload via the Security tab)
- VS Code SARIF Viewer extension
- GitLab, Sonatype, DefectDojo, and most security dashboards
Raw JSON is also available for custom pipelines.
Supported inputs
Source files for mainstream stacks, plus configs and archives.
Privacy & retention
Your source code is not retained after a scan completes. We persist only the scan metadata (target name, mode, timestamp) and the structured report so you can revisit findings later.
Payloads are not used to train any model. Deleting a scan from History removes the report from our database.
Limits
- Per-file: 15 MB
- Per-scan payload: 500,000 characters total
- Rate limits: not enforced during public preview — be reasonable.
- History retention: scans stay in your workspace until you delete them.