Introduction

Dedge is a Decentralized Application Security Posture Management (dASPM) platform for Web3 teams. Connect your repositories, set up a configuration, and Dedge runs a suite of security analyzers, then uses AI to help you cut through false positives and focus on what matters.

Get Started →

What Dedge Scans

Every scan covers your project from multiple angles:

Category	What It Finds
Smart Contract Vulnerabilities	Reentrancy, unchecked transfers, state variable shadowing, integer overflow, and 180+ more rule-based detectors for Solidity (EVM), Rust (Solana), and DAML (Canton)
AI-Powered Code Analysis	Business-logic vulnerabilities in Solidity contracts surfaced by an AI analyzer, issues that depend on a contract's logic and intent, in addition to the rule-based detectors
Dependency Vulnerabilities (SCA)	Known CVEs in npm packages and Cargo crates
Secrets Detection	Leaked API keys, wallet private keys, tokens, and credentials across your full git history
Infrastructure as Code	Misconfigurations in Terraform, Kubernetes, GitHub Actions, and CloudFormation, covering blockchain node infrastructure and deployment pipelines
Compliance	Regulatory compliance checks for stablecoin and token contracts, GENIUS Act (available), MiCA and DORA (coming soon)

Every finding is mapped to a DWE ID (Dedge Weakness Enumeration), a standardized identifier with severity, description, and remediation guidance. See the full Vulnerability Detectors Reference.

Supported Ecosystems

Ecosystem	Frameworks	Languages
EVM / Solidity	Hardhat, Foundry	Solidity 0.4.x – 0.8.x
Solana	Anchor, Native	Rust
Canton / DAML	DAML SDK	DAML
Dependencies	npm, yarn, pnpm, bun, forge, Cargo	JavaScript, TypeScript, Rust
Infrastructure	Terraform, Kubernetes, GitHub Actions	HCL, YAML

See Vulnerability Detectors Reference for the full support matrix.

How It Works

1. Set up a dedge.config.yaml, commit it to your repo or manage it in the platform; it tells Dedge how to compile and scan your project
2. Set up a connector, go to the Connector page and connect your GitHub or GitLab account
3. Add a project, go to the Projects page, click Add Project (top right), and select a repository and branch
4. Trigger a scan, from the Projects page, open the project's quick actions menu, or from the project detail page, click Scan
5. Review and triage, you can view the scan report for a snapshot of findings. For ongoing work, use the persistent Issues list to acknowledge findings, mark false positives, or create Jira tickets.

Optional: automate with CI/CD

Instead of triggering scans manually, you can set up a CI/CD integration to scan automatically on every push or pull request. See CI/CD Integration.

A typical scan takes 5–15 minutes depending on project size. Dedge clones your code into a secure, isolated container, runs all enabled analyzers in parallel, maps findings to DWE IDs, and presents results with code snippets and line numbers.

Platform Capabilities

• AI Evaluation & Remediation, AI help to triage false positives and suggest fixes from the Issues list
• Issue Lifecycle Management, Acknowledge, mark false positive, ignore, or create Jira tickets directly from findings
• Slack Integration, Receive notifications when scans are triggered and completed, with direct links to scan reports
• Jira Integration, Create tickets directly from evaluated issues in your persistent issues list
• CI/CD API, Trigger scans from GitHub Actions, GitLab CI, or any pipeline with a single API call
• Cloud Monitoring, Add your blockchain nodes or smart contracts under Monitor and create custom alert rules based on events or functions

Architecture at a Glance

Code Scanning Pipeline

Your code never leaves Dedge's secure infrastructure:

1. Clone, Dedge pulls your repo into an isolated container
2. Build, Dependencies are installed and contracts compiled per your dedge.config.yaml
3. Scan, All enabled analyzers run in parallel inside isolated containers
4. Process, Results are normalized to DWE IDs, deduplicated, and reconciled with previous scans
5. Clean up, Source code is deleted after processing; only findings are stored

Smart Contract & Node Monitoring

The Monitor section of the Dedge console lets you monitor your deployed smart contracts and blockchain nodes:

• Smart Contract Monitoring, Add standalone contracts, parent-child contract groups, or proxy contract patterns. Create alert rules based on specific events or function calls to get notified when something unexpected happens.
• Node Monitoring, Monitor the health and availability of your blockchain nodes (RPC endpoints).
• Alert Rules & Webhooks, Configure alert rules per contract or node based on events or functions. Alerts can trigger notifications (Slack, email) or generate webhooks for custom integrations.

Monitoring is configured separately from code scanning and does not require a dedge.config.yaml. Navigate to Monitor in the console to get started.

---

Get Started →

Need help? Check the Troubleshooting Guide or reach out to our support team.