Code Security
Path: /code → /code/repositories · Sidebar: Testing → Code Security
Code Security covers everything that scans your source and artifacts rather than a running app: static analysis (SAST), dependencies (SCA), container images, infrastructure-as-code (IaC) and secrets. They share one home - the Repositories overview - and feed the same unified Vulnerabilities hub.
Repositories overview
Path: /code/repositories
A single table of every connected repository with its status across all engines: SAST, SCA, container, IaC and secrets. You can:
- Group by Product to see microservices together (see Products).
- See the last scan time and finding counts per engine.
- Scan a repo (or bulk-scan a product) on demand.
Repositories are connected via Integrations and cloned on demand at scan time - there's no need to pre-stage source.
The engines at a glance
| Engine | Finds | Page |
|---|---|---|
| SAST | Vulnerable code patterns & taint flows | SAST |
| SCA | Vulnerable / malicious / mis-licensed dependencies | SCA |
| Containers | OS & library CVEs in images | Containers |
| IaC | Misconfigurations in Terraform/CFN/K8s | IaC |
| Secrets | Leaked keys, tokens, credentials | Secrets |
How code scanning fits the pipeline
Code engines run on demand from this page, automatically in CI/CD, or on a schedule. Results are deduplicated against DAST findings into unified vulnerabilities, so the same issue found by two tools shows up once.