Security Agent sourceCode and documents use fundamentally different processing pipelines

Tested both sourceCode and documents for providing source code to Security Agent pentests. The internal tasks during STATIC_ANALYSIS were completely different.

With documents:

DOCUMENTS        → COMPLETED
SCANNER          → COMPLETED
TLS SCANNER      → COMPLETED
CRAWLER          → IN_PROGRESS

With sourceCode:

CODE SCANNER [BUSINESS LOGIC]      → IN_PROGRESS
CODE SCANNER [IMPORTANT FLOWS]     → IN_PROGRESS
CODE SCANNER [FRAMEWORKS]          → IN_PROGRESS
SCANNER                            → COMPLETED
TLS SCANNER                        → COMPLETED

sourceCode runs three CODE SCANNER tasks in parallel for systematic static analysis, detecting vulnerabilities before the PENTEST phase even starts. VALIDATOR TASKs then dynamically verify each finding before proceeding to CRAWLER → PENTEST. Result: sourceCode produced 28 findings (more than double documents' 13). The broader static analysis did produce 4 FALSE_POSITIVEs (auto-classified by VALIDATOR).