diff --git a/go.mod b/go.mod
index 7a59be8..f4fd70a 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/puzpuzpuz/xsync v1.5.2
 	github.com/rs/zerolog v1.34.0
 	github.com/snyk/error-catalog-golang-public v0.0.0-20260806122555-28dc45bbbde6
-	github.com/snyk/go-application-framework v0.16.1
+	github.com/snyk/go-application-framework v0.18.2-0.20260825125146-df40372f0509
 	github.com/spf13/pflag v1.0.6
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/net v0.57.0
diff --git a/go.sum b/go.sum
index aae48e5..6377b02 100644
--- a/go.sum
+++ b/go.sum
@@ -246,8 +246,8 @@ github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnB
 github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/snyk/error-catalog-golang-public v0.0.0-20260806122555-28dc45bbbde6 h1:XUPFP85nBh+zDCTvxxBuouZP9yG7H1qXZiMGFVMWVKM=
 github.com/snyk/error-catalog-golang-public v0.0.0-20260806122555-28dc45bbbde6/go.mod h1:0dz+HUR/r7VLlQpLfF0a/F1tdHH84NLTZzCxjZ+Q1nk=
-github.com/snyk/go-application-framework v0.16.1 h1:k4eyP4EX/kqnNyu5uuFLEw4wflTom22ea23ZuG74JU8=
-github.com/snyk/go-application-framework v0.16.1/go.mod h1:qJBU+FIY8s/lIg0IaKBj7WGeGERiWqyJvhajzxiA3Ls=
+github.com/snyk/go-application-framework v0.18.2-0.20260825125146-df40372f0509 h1:u0rM+W6It0MmwnxmUsujp/D0HPDubEcurBidbuKVJr4=
+github.com/snyk/go-application-framework v0.18.2-0.20260825125146-df40372f0509/go.mod h1:UJMR1Tk4OPGFa03O9cko4ic0GeaqmSO03fx55HpOFp0=
 github.com/snyk/go-httpauth v0.0.0-20260810142636-0f6182aaccbc h1:tuZVhmJFxS4qJlwYIIIw8xgw3VaVqIR3IAV0WaaFVnI=
 github.com/snyk/go-httpauth v0.0.0-20260810142636-0f6182aaccbc/go.mod h1:f42qLL7WXOS0od7dXJV/hK3myjms/r6HsXgLrg1HRRY=
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
diff --git a/internal/commands/code_workflow/native_workflow.go b/internal/commands/code_workflow/native_workflow.go
index ddffc10..9762cea 100644
--- a/internal/commands/code_workflow/native_workflow.go
+++ b/internal/commands/code_workflow/native_workflow.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"os"
 	"path"
 	"path/filepath"
@@ -358,11 +359,17 @@ func determineAnalyzeInput(invocationCtx workflow.InvocationContext, path string
 
 	var files <-chan string
 
-	pathIsDirectory := false
-	if fileinfo, fileInfoErr := os.Stat(path); fileInfoErr == nil && fileinfo.IsDir() {
-		pathIsDirectory = true
+	linfo, err := os.Lstat(path)
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot access path %q: %w", path, err)
+	}
+
+	if linfo.Mode()&os.ModeSymlink != 0 {
+		return nil, nil, fmt.Errorf("path %q is a symbolic link; pass the real path instead", path)
 	}
 
+	pathIsDirectory := linfo.IsDir()
+
 	if !pathIsDirectory {
 		target, err := scan.NewRepositoryTarget(filepath.Dir(path), scan.WithRepositoryUrl(config.GetString(configuration.FLAG_REMOTE_REPO_URL)), scan.WithCommitId(config.GetString(ConfigurationCommitId)))
 		if err != nil {
diff --git a/internal/commands/code_workflow/native_workflow_test.go b/internal/commands/code_workflow/native_workflow_test.go
index bc9354a..a361d1a 100644
--- a/internal/commands/code_workflow/native_workflow_test.go
+++ b/internal/commands/code_workflow/native_workflow_test.go
@@ -464,6 +464,29 @@ func Test_determineAnalyzeInput(t *testing.T) {
 
 		assert.Equal(t, 1, count)
 	})
+
+	t.Run("rejects a symlink to a file", func(t *testing.T) {
+		ictx := testInvocationContext(t, config, &logger, nil, nil, analytics.New())
+
+		link := filepath.Join(path, "link.txt")
+		require.NoError(t, os.Symlink(filenames[0], link))
+		t.Cleanup(func() { os.Remove(link) })
+
+		_, _, err := determineAnalyzeInput(ictx, link)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "symbolic link")
+	})
+
+	t.Run("rejects a symlink to a directory", func(t *testing.T) {
+		ictx := testInvocationContext(t, config, &logger, nil, nil, analytics.New())
+
+		linkDir := filepath.Join(t.TempDir(), "linked-repo")
+		require.NoError(t, os.Symlink(path, linkDir))
+
+		_, _, err := determineAnalyzeInput(ictx, linkDir)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "symbolic link")
+	})
 }
 
 func Test_TrackUsage(t *testing.T) {