Finds vulnerabilities in the code your team wrote and in the dependencies it pulled in.
Labrador runs SAST and SCA in the same scan. It tunes its rule set to your stack rather than shipping one global default, and it uses reachability analysis on dependency findings to separate the ones that matter from the ones that are merely present.
That distinction is the whole point. Most code scanners are not short on detection. They are short on judgment, and a queue of four thousand findings gets abandoned rather than worked.
It generates SBOMs in CycloneDX and SPDX, runs in CI, and reports where your developers already are.
Who runs it: AppSec teams and engineering groups shipping their own code, usually ones who already tried a scanner and stopped reading its output.
A solutions engineer runs it on your own systems and tunes the configuration to your stack. You end with data about your environment, not a sample report.