Yeah it's complicated. Scanning is useful to automate a "thing" but your audit is multifaceted and should probably require peer review (pull/merge requests).

Yeah it's complicated. Scanning is useful to automate a "thing" but your audit is multifaceted and should probably require peer review (pull/merge requests). In simple terms, scanning should _hopefully_ help a dev who wants to do the right thing, but it won't help a malicious dev, so you're gonna need something else. Peer review, least privileged access, protective monitoring, etc.