> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/readme.md).

# Introduction

Nullify connects security findings to the code, applications, cloud resources, and teams behind them. It helps investigate risk, plan remediation, and prepare fixes for human review.

## Start with your environment

[Install Nullify](/getting-started/install.md), then complete [onboarding](/getting-started/getting-started.md): connect source control, enroll repositories, configure workflow destinations, and provide business context. Cloud and runtime assessments need their own connections, targets, credentials, and authorization.

The [Context Engine](/capabilities/context-engine.md) builds relationships from the information available to it. Missing connections or incomplete scans limit that view; connecting one repository does not establish coverage of your entire organization.

## Assess and prioritize

| Capability                                                               | What it examines                                                             |
| ------------------------------------------------------------------------ | ---------------------------------------------------------------------------- |
| [Code Analysis](/capabilities/code-reviews/code-analysis.md)             | Supported source-code and infrastructure-as-code patterns.                   |
| [Dependency Analysis](/capabilities/code-reviews/dependency-analysis.md) | Package and container vulnerabilities, with reachability where supported.    |
| [Secrets Detection](/capabilities/code-reviews/secrets-detection.md)     | Exposed credentials and, when enabled, sensitive data.                       |
| [Supply Chain Posture](/capabilities/scpm.md)                            | Package policy, metadata, suspicious behavior, and known malicious packages. |
| [Cloud Audits](/capabilities/cloud-audits.md)                            | Collected cloud and Kubernetes configuration.                                |
| [Bug Hunts](/capabilities/bug-hunts.md)                                  | Authorized external attack-surface discovery and selected testing suites.    |
| [Pentests](/capabilities/pentests.md)                                    | Scoped application testing with engagement evidence and coverage reporting.  |

[Triage](/capabilities/triage.md) weighs reachability, exploitability, and business context to prioritize findings. [Exploit Validation](/capabilities/pentests/exploit-validation.md) can test selected findings against an authorized non-production target under an enabled, armed policy. An untested or inconclusive finding is not evidence that a vulnerability is absent.

## Plan and remediate

[Security Program Management](/capabilities/program-management.md) organizes strategies and campaigns around risk, team capacity, and your policies. [Remediations](/capabilities/remediations.md) can propose patches and work through CI feedback and review. Inspect the evidence and current checks before merging; a generated patch is not a guarantee of correctness.

When human input is required, Nullify raises [action items](/capabilities/working-with-nullify.md). Use [configuration](/configuration/configuration-general.md) to control PR checks, ticketing, notifications, and allowed actions.

## Integrate and automate

Browse [connectors](/connectors/connectors.md) for setup and availability, the [public CLI](/cli/cli.md) for terminal and CI workflows, and the [API reference](/api-reference/api-reference.md) for direct integrations. Feature availability, permissions, and deployment versions can differ between tenants; each guide calls out relevant limits.