Run real SAST and secret-scanning tools locally (semgrep, bandit, gitleaks, trivy). Use when auditing a codebase for vulnerabilities, exposed secrets, or vulnerable dependencies before shipping or on demand.
