Xolvyn analyzes repository source to produce a structural map and security findings. This description does not assert benchmark timings.
1. Temporary Clone
The analyzer shallow-clones the selected repository into a temporary server-side directory. Private repositories require authorized provider credentials. The clone is written to disk; analysis is not an in-memory-only operation.
2. Discover and Analyze Files
Supported files are examined for imports, exports and declarations. Repository size, syntax and language support affect the results. File and size limits apply.
3. Resolve Imports
Imports that resolve to repository files become directed graph edges. Packages and unresolved imports are not equivalent to cross-file call relationships. The map is tied to the analyzed source, not to runtime traces.
4. Run Available Checks
The pipeline runs available source, secret, infrastructure and dependency checks. Results should be reviewed with their locations, severity and coverage limitations. A completed scan is not a certification of security.
5. Return Results and Attempt Cleanup
The pipeline attempts clone cleanup after analysis and logs cleanup failures. Signed-in analysis history saves metadata; source-bearing report fields are removed before persistence.
Temporary clone cleanup does not establish every provider, log, browser or backup retention behavior. Review data handling before connecting private code.
Keep the Limits Visible
Analysis duration depends on repository size, provider access and the checks performed. The dependency map describes structural imports; runtime behavior and exploitability require further evidence.