Skip to main content

Honest Boundaries

What Zelsis does not check. We believe in transparency about the limits of static analysis.

Measured Efficacy

On a corpus of 118 vulnerable snippets modelled on public incidents and advisories, the engine flags 86% as HIGH/CRITICAL on the vulnerable line, and 99% when MEDIUM findings are included. The corpus is published here, and our test suite re-measures it on every release.

What it misses there: the zip-slip snippet (adm-zip extractAllTo), on purpose: adm-zip blocks that attack since 0.4.11, so flagging it would be a false alarm on current versions. The 15 snippets that only reach MEDIUM are mostly issues rated MEDIUM by convention, such as open redirects, timing-unsafe signature comparisons and GraphQL introspection.

1. Runtime and DAST

Zelsis is a Static Application Security Testing (SAST) tool. It analyzes source code at rest. We do not perform Dynamic Application Security Testing (DAST): no attack payloads, no fuzzing, no runtime monitoring. A live-site scan reads your pages and scripts and requests a fixed list of well-known file paths (such as /.env and /.git/config); the longer list of dump and admin paths runs only on domains you have verified.

2. Complex Business Logic Flaws

Most rules read one file at a time. A set of cross-file checks links code to migrations, env templates, Dockerfiles, proxy configs and (for JavaScript and TypeScript) auth helpers and middleware. None of this reasons about multi-step business logic that spans several decoupled systems.

Examples of limitations:

  • IDOR without ownership: We can detect missing authorization middleware, but we cannot mathematically prove that a specific IDOR check correctly matches the currently logged-in user's ID.
  • Cross-file context: We cannot detect a Laravel $guarded = [] vulnerability if the dangerous $request->all() call happens in a completely different, decoupled file.
  • Framework-specific implicit routing: Unauthenticated GraphQL resolvers or FastAPI routes that rely on complex implicit decorators might be missed if they deviate heavily from standard patterns.
  • Publicly exposed lists: Clerk public route lists or intentionally public data that look identical to misconfigurations.

3. Live Database Configurations

We analyze your database schema definitions and migration files (e.g., checking if FOR SELECT USING (true) is used in a SQL file). However, we do not connect to your live production database to inspect its running configuration.

Recommendation: To audit the live configuration of a Supabase database, we highly recommend using the official Supabase Security Advisor built into their dashboard.