Code issues
The code issues scanner performs static application security testing on your source code. It identifies insecure patterns, injection vulnerabilities, and language-specific anti-patterns without executing any code. Findings are prioritized according to their confirmed impact and presented in order of importance.
What it detects
Injection flaws
SQL injection, command injection, LDAP injection, and OS command execution where user input flows into sensitive operations without sanitization.
Cross-site scripting (XSS)
Reflected, stored, and DOM-based XSS patterns across frontend frameworks and server-rendered templates.
Authentication and authorization
Weak password policies, hardcoded credentials, session management flaws, privilege escalation paths, and broken access control patterns.
Cryptography issues
Use of weak encryption algorithms, insecure random number generation, and hardcoded cryptographic keys or salts.
Framework-specific patterns
Security misconfigurations in Django, Express.js, Spring, Rails, Vue.js, and other popular frameworks - including unsafe cookie settings, disabled CSRF protection, and misconfigured CORS.
Supported languages
The scanner supports a wide range of languages and detects issues using community-maintained rule sets that are regularly updated:
- JavaScript
- TypeScript
- Python
- Java
- Go
- C / C++
- PHP
- Ruby
- C#
- Kotlin
- Swift
How it works
The scanner downloads the repository archive, extracts it, and runs a rule-based static analysis engine against the source code. Language detection is automatic based on file extensions. Each rule defines a pattern to match and metadata describing the vulnerability, its severity, and how to fix it.
Each finding is reviewed to determine whether outside input can realistically reach the affected part of the application. That information is then combined with the potential impact and the likelihood of misuse to prioritize findings based on how likely they are to be exploitable, rather than on severity alone. Findings that have clear evidence of a realistic attack path are ranked first, while those with less evidence or lower impact are kept but given lower priority. This reduces unnecessary noise by highlighting the small set of issues that are most important to address, instead of presenting the entire list of scan results as equally urgent.
Duplicate findings across different rules targeting the same code location are automatically deduplicated before results are published.