One scan covers code, secrets, dependencies, licenses, and images, with a gate of pass, fail, inconclusive, or skipped. Engines are OpenGrep, Gitleaks, and Trivy.