Part II · Mental Model · Mechanism 02 · SHIPPED · p. 28–30
Twelve scanners, then one ladder
Meet the built-in set as scenes, not a registry. Then climb the plugin ladder slowly — most teams correctly stop at rung zero on the hot path.
Imagine a colleague pastes a repo link at 11:40. You acquire it. The built-ins run before the tree becomes “yours.” Together they cover code, dependencies, pipelines, infrastructure, runtime execution paths, binaries, and repository metadata. That is why rung zero is enough for most hot paths.
Twelve scanners are not a product brochure. They are twelve reasons an archive is still inert when you start reading the report.
One ladder story — climb slowly
- Rung 0 · Built-in only. Start here. Most teams correctly stay on the hot path.
- Rung 1 · One external plugin that matches your stack. Scheduled scans, not the pre-commit loop.
- Rung 2 · A secrets specialist beside the built-in. Different pattern databases; overlap is not total.
- Rung 3 · A SAST engine. Semgrep-class depth. Nightly or per-PR.
- Rung 4 · Specialized and compliance. Container linting, IaC extras, license detection — per repository, not per keystroke.
| Type | Location | Performance | Status |
|---|---|---|---|
| Built-in (Rust) | compiled in | 0 ms startup | SHIPPED |
| External (any language) | ~/.config/securegit/plugins/ | 20–50 ms startup | SHIPPED |
| Native dynamic (Rust + FFI) | plugins/*.so | near-native | PLANNED |
| WebAssembly | plugins/*.wasm | fast, sandboxed | PLANNED |