The Safe Codebase Audit Pipeline (SCAP) is a distributed system for analyzing third-party JARs before any client deserializes objects from them, addressing supply chain compromise risks in dynamic Java service meshes. SCAP targets two threat categories: malicious bytecode (gadget chains, native calls, permission escapes) and blocking static initializers that can stall the JVM scheduler. The pipeline distributes work across five isolated hosts — Lookup Service, Codebase Downloader, Bytecode Analysis Engine (BAE) pool, Verdict Registry, and JFR Telemetry Service — each with minimal network access. The BAE applies four ASM-based visitors per class: a clinit blocking visitor, an AtomicSerial compliance visitor, a cyclic clinit deadlock detector, and PERMISSIONS.LIST integration. Verdicts are keyed by SHA-256 content hash and issued only after a quorum of independent engines agrees, preventing any single compromised engine from writing its own verdict.
