# False Positive Elimination
Source: https://codethreat.mintlify.app/ai/false-positive-elimination
Automatic identification and filtering of false security findings
CodeThreat's AI automatically analyzes violations to identify and filter false positives, reducing alert fatigue and allowing you to focus on real security issues.
## How False Positive Elimination Works
False Positive Elimination is the only agentic feature that works after deterministic SAST analysis. It processes deterministic SAST findings:
```mermaid theme={null}
flowchart LR
A[Deterministic
SAST Scan] --> B[SAST Findings]
B --> C[False Positive
Elimination Agent]
C --> D{AI Checks
Context}
D -->|Safe| E[Filter Out
False Positive]
D -->|Exploitable| F[Keep
Real Issue]
D -->|Uncertain| G[Flag for
Review]
style A fill:#9449FE,stroke:#6627F9,color:#fff
style B fill:#9449FE,stroke:#6627F9,color:#fff
style C fill:#6627F9,stroke:#9449FE,color:#fff
style F fill:#6627F9,stroke:#9449FE,color:#fff
```
**Note**: False Positive Elimination only works on deterministic SAST results. SCA, Secrets Detection, and IaC Security findings use deterministic CVE matching and pattern detection, so they don't need filtering.
**Other agentic features** (Agentic SAST, PR Reviews) are separate capabilities that don't depend on deterministic scanning.
***
## Enable False Positive Elimination
**Repository Settings** β **AI Features**
Toggle **False Positive Elimination** to enabled
Select aggressiveness:
* **Conservative**: Only filter obvious false positives
* **Balanced**: Recommended default setting
* **Aggressive**: More aggressive filtering
Save settings and trigger new scan
***
## Filtering Levels
### Conservative
Filters only extremely obvious false positives. Use when you want maximum sensitivity.
### Balanced (Recommended)
Filters false positives with high confidence. Optimal for most teams.
### Aggressive
Filters any violation the AI suspects might be a false positive. Use when overwhelmed with findings.
Start with **Balanced**. If still seeing too many false positives, increase to **Aggressive**. If concerned about missing issues, decrease to **Conservative**.
***
## What the AI Checks
### Input Validation
AI looks for type checking, regex validation, whitelists, range validation, and length limits.
### Framework Protections
AI recognizes Django ORM, React JSX escaping, Rails sanitization, Spring Security, and more.
### Dataflow Analysis
AI tracks where data comes from, what transformations are applied, and whether sanitization occurs.
### Dead Code Detection
AI identifies unreachable code and test-only code paths.
***
## AI Learning
The AI learns from your codebase:
* **Pattern recognition**: Identifies your validation patterns
* **Framework usage**: Understands how you use frameworks
* **False positive patterns**: Learns what you consider false positives
* **Continuous improvement**: Gets better with each scan
***
## Results
After AI analysis, violations are marked:
* β
**Reviewed by AI**: AI examined and determined it's real
* β οΈ **Likely False Positive**: AI thinks this isn't exploitable
* π **Needs Human Review**: AI couldn't determine automatically
***
## Best Practices
* Enable false positive elimination for all repositories
* Start with Balanced filtering level
* Review AI-filtered items periodically
* Provide feedback on AI decisions
* Monitor false positive rate over time
***
## Next Steps
Complete violation workflow
Manual false positive management
# AI Features Overview
Source: https://codethreat.mintlify.app/ai/overview
How CodeThreat's AI improves security accuracy and provides intelligent insights
CodeThreat's AI engine analyzes your code with human-like understanding to eliminate false positives and provide intelligent security insights.
## Agentic Security - AI That Acts Autonomously
CodeThreat's AI doesn't wait for instructions - it actively works as an autonomous security engineer on your team.
## Agentic Security Capabilities
CodeThreat's AI agents operate autonomously to analyze code and provide intelligent security insights.
Analyzes deterministic SAST results to reduce false positives
Reviews pull requests with contextual security analysis
Deep code analysis for complex vulnerabilities
On-demand repository security analysis
## False Positive Elimination
The False Positive Elimination agent analyzes deterministic SAST results to reduce false positives by understanding code context, framework protections, and actual exploitability.
[Learn more β](/ai/false-positive-elimination)
## Agentic SAST
Agentic SAST performs deep code analysis using graph-based analysis to identify logic flaws, authorization issues, and design failures that traditional rule-based SAST cannot detect.
[Learn more β](/platform/agentic-sast)
## Enable AI Features
Go to **Repository Settings** β **AI Features**
Toggle the AI features you want:
* β
**False Positive Elimination** (works on deterministic SAST results)
* β
**AI PR Reviews**
* β
**Agentic SAST**
Click **Save** to activate AI features
## What's Next?
Set up automatic filtering
Enable intelligent PR analysis
# AI Pull Request Reviews
Source: https://codethreat.mintlify.app/ai/pr-reviews
Intelligent security analysis of pull requests
Get AI-powered security feedback directly in your pull requests to prevent vulnerabilities before they're merged.
## What AI PR Reviews Provide
Identify security issues in code changes
AI-generated fix recommendations
Critical, High, Medium, Low priorities
How certain the AI is about each finding
***
## Enable AI PR Reviews
**Repository Settings** β **Pull Requests**
Toggle **AI PR Reviews** to enabled
Set preferences:
* Post PR comments
* Summary comment
* Suggestion threshold
Click **Save** to activate
***
## How It Works
The AI autonomously reviews every PR for security:
1. **Understands What Changed**: Analyzes code intent and architecture impact
2. **Analyzes Security Impact**: Traces how changes affect security
3. **Thinks Across Files**: Sees connections across multiple files
4. **Provides Specific Fixes**: Code examples tailored to your framework
5. **Rates Priority and Confidence**: Clear guidance on urgency
### Why Agentic PR Reviews Matter
**Traditional PR scanning**: Runs rules on changed lines, reports findings
**Agentic PR reviews**: AI actively investigates code changes, understands architectural impact, provides contextual feedback
***
## PR Review Components
### Summary Comment
Posted at PR level with overall security status:
* Security status (Success/Warning/Failed)
* Summary of issues found
* Priority breakdown
* Links to detailed analysis
### Inline Comments
Posted on specific lines with vulnerabilities:
* Issue description
* Security impact
* Fix recommendations
* Code examples
* Priority and confidence scores
### GitHub Check Status
AI review appears as a check:
* β
**Success**: No Critical/High security issues
* β **Failed**: Security concerns requiring attention
* β³ **Pending**: AI analysis in progress
***
## Configuration
Configure PR review behavior:
* **Post PR comments**: Add inline security feedback
* **Summary comment**: Overall security assessment
* **Suggestion threshold**: Minimum priority to comment
* **Block merge on failure**: Prevent merging PRs with Critical/High violations
***
## Best Practices
* Enable AI PR reviews for all repositories
* Review AI suggestions promptly
* Provide feedback to improve AI accuracy
* Use threshold settings to reduce noise
* Combine with automated scanning for comprehensive coverage
***
## Next Steps
Set up automatic PR scanning
Configure GitHub check status
# On-Demand Security Analysis
Source: https://codethreat.mintlify.app/ai/security-analysis
Request AI-powered security reviews for specific code or scenarios
Beyond automatic scanning, request AI-powered security analysis for specific files, features, or scenarios.
## Agentic Code Analysis (AGENTIC\_SAST)
Beyond traditional SAST rules, CodeThreat's AI can analyze code with human-like intelligence.
**What it finds that traditional SAST can't**:
* Authorization flaws (business logic vulnerabilities)
* Race conditions in concurrent code
* Complex authentication bypass vectors
* Business logic vulnerabilities
* Context-dependent security issues
### When to Use Agentic Analysis
Deep analysis of authentication, payment processing, admin functions
Comprehensive review before deploying to production
Understand how a vulnerability was introduced
Verify security fixes actually eliminate the vulnerability
***
## Request Analysis
Open the repository you want to analyze
Click **AI Security Analysis** in the repository menu
Select what to analyze:
* Specific file
* Directory
* Feature (related files)
* Full repository
Provide context like:
* "Analyze authentication logic for bypass vulnerabilities"
* "Review payment processing for security issues"
* "Check if admin endpoints are properly protected"
Click **Request Analysis**
Results appear in **AI Analysis Reports** tab, typically within 5-15 minutes
***
## Analysis Report
AI-generated security analysis report includes:
### Executive Summary
* Overall security posture
* Critical, High, Medium, Low issue counts
* Key findings summary
* Analysis duration
### Detailed Findings
Each finding includes:
* **Vulnerability description**: Clear explanation
* **Location**: File, line number, code snippet
* **Attack scenario**: How an attacker could exploit this
* **Impact**: What data/functionality is at risk
* **Recommendation**: Specific steps to fix
* **Code example**: Secure implementation
* **Priority**: Critical, High, Medium, Low
* **Confidence**: AI's certainty level
### Architecture Insights
* Security strengths
* Security weaknesses
* Recommendations for improvement
***
## Best Practices
* Use for critical features before release
* Request analysis after major refactoring
* Analyze authentication and authorization logic
* Review payment processing code
* Verify security fixes are effective
***
## Next Steps
Learn about AI-powered analysis
AI-powered PR reviews
# Authentication
Source: https://codethreat.mintlify.app/api-reference/authentication
Secure your API requests with API keys
## Overview
The CodeThreat API uses API keys to authenticate requests. You can generate and manage your API keys from your organization settings in the [CodeThreat dashboard](https://app.codethreat.com).
**Keep your API keys secure!** Never commit API keys to source control or expose them in client-side code.
***
## Getting Your API Key
Log into your CodeThreat dashboard and go to **Organization Settings** β **API Keys**.
Click **Generate API Key** and provide a descriptive name (e.g., "CI/CD Pipeline", "Development").
Copy the generated API key immediately. For security, it won't be shown again.
Include the API key in the `X-API-Key` header of all API requests.
***
## Making Authenticated Requests
Include your API key in the `X-API-Key` header:
```bash cURL theme={null}
curl --request GET \
--url 'https://app.codethreat.com/api/v1/organizations' \
--header 'X-API-Key: YOUR_API_KEY'
```
```javascript JavaScript theme={null}
const response = await fetch('https://app.codethreat.com/api/v1/organizations', {
method: 'GET',
headers: {
'X-API-Key': 'YOUR_API_KEY',
'Content-Type': 'application/json'
}
});
const data = await response.json();
```
***
## Environment Variables
Store API keys as environment variables for security:
```bash theme={null}
export CODETHREAT_API_KEY="your_api_key_here"
curl --request GET \
--url 'https://app.codethreat.com/api/v1/organizations' \
--header "X-API-Key: $CODETHREAT_API_KEY"
```
***
## Error Responses
### 401 Unauthorized
Missing or invalid API key:
```json theme={null}
{
"success": false,
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required. Please provide a valid API key."
},
"meta": {
"timestamp": "2025-01-15T10:30:00Z",
"version": "v1",
"requestId": "req_123456"
}
}
```
### 403 Forbidden
Valid API key but insufficient permissions:
```json theme={null}
{
"success": false,
"error": {
"code": "FORBIDDEN",
"message": "You don't have permission to access this resource."
},
"meta": {
"timestamp": "2025-01-15T10:30:00Z",
"version": "v1",
"requestId": "req_123456"
}
}
```
***
## API Key Best Practices
Rotate API keys every 90 days or when team members leave
Name keys by purpose: "Production CI/CD", "Staging Environment"
Use the minimum required permissions for each key
Track API key usage in your audit logs
***
## Validate Your API Key
Test your API key with the CLI validation endpoint:
```bash theme={null}
curl --request GET \
--url 'https://app.codethreat.com/api/v1/cli/auth/validate' \
--header 'X-API-Key: YOUR_API_KEY'
```
**Success Response:**
```json theme={null}
{
"success": true,
"data": {
"valid": true,
"user": {
"id": "usr_123",
"email": "user@example.com",
"name": "John Doe"
},
"organizations": [...],
"permissions": ["read:scans", "write:scans"],
"authenticatedAt": "2025-01-15T10:30:00Z"
}
}
```
***
## Next Steps
Browse available API endpoints
Integrate with your pipeline
# CLI
Source: https://codethreat.mintlify.app/api-reference/cli
GET /cli/info
Get CLI-specific information including supported features, versions, and capabilities
```bash cURL theme={null}
curl --request GET \
--url 'https://app.codethreat.com/api/v1/cli/info'
```
# Organizations
Source: https://codethreat.mintlify.app/api-reference/organizations
GET /organizations
Get a paginated list of organizations for the authenticated user
```bash cURL theme={null}
curl --request GET \
--url 'https://app.codethreat.com/api/v1/organizations' \
--header 'X-API-Key: YOUR_API_KEY'
```
# Repositories
Source: https://codethreat.mintlify.app/api-reference/repositories
GET /repositories
Get a paginated list of repositories for the authenticated organization
# Repositories API
Manage repositories programmatically via API.
## List Repositories
```http theme={null}
GET /v1/repositories
```
**Response**:
```json theme={null}
{
"repositories": [
{
"repository_id": "repo_123",
"name": "my-app",
"vcs_provider": "github",
"default_branch": "main",
"last_scan_at": "2024-03-15T14:35:42Z",
"security_score": 85
}
],
"pagination": {
"page": 1,
"total": 15
}
}
```
## Get Repository
```http theme={null}
GET /v1/repositories/:repository_id
```
**Response**:
```json theme={null}
{
"repository_id": "repo_123",
"name": "my-app",
"vcs_provider": "github",
"vcs_url": "https://github.com/org/my-app",
"default_branch": "main",
"security_score": 85,
"total_violations": 27,
"violations_by_severity": {
"critical": 2,
"high": 5,
"medium": 12,
"low": 8
},
"last_scan_at": "2024-03-15T14:35:42Z",
"created_at": "2024-01-10T09:00:00Z"
}
```
## Update Repository Settings
```http theme={null}
PATCH /v1/repositories/:repository_id
```
**Request**:
```json theme={null}
{
"auto_scan_on_push": true,
"auto_scan_on_pr": true
}
```
## What's Next?
Trigger repository scans
View repository violations
# Scans
Source: https://codethreat.mintlify.app/api-reference/scans
GET /scans
Get a paginated list of security scans
# Scans API
Trigger and manage security scans via API.
## Trigger Scan
```http theme={null}
POST /v1/scans
```
**Request**:
```json theme={null}
{
"repository_id": "repo_123",
"branch": "main"
}
```
**Response**:
```json theme={null}
{
"scan_id": "scan_456",
"status": "PENDING",
"repository_id": "repo_123",
"branch": "main",
"created_at": "2024-03-15T14:32:18Z"
}
```
## Get Scan Status
```http theme={null}
GET /v1/scans/:scan_id
```
**Response**:
```json theme={null}
{
"scan_id": "scan_456",
"status": "COMPLETED",
"repository_id": "repo_123",
"branch": "main",
"violations": {
"critical": 2,
"high": 5,
"medium": 12,
"low": 8,
"info": 0
},
"started_at": "2024-03-15T14:32:20Z",
"completed_at": "2024-03-15T14:35:42Z"
}
```
## List Scans
```http theme={null}
GET /v1/scans?repository_id=repo_123&limit=10
```
**Response**:
```json theme={null}
{
"scans": [
{
"scan_id": "scan_456",
"status": "COMPLETED",
"created_at": "2024-03-15T14:32:18Z"
}
],
"pagination": {
"page": 1,
"total": 42
}
}
```
## What's Next?
Get violation data
Manage repositories
# System
Source: https://codethreat.mintlify.app/api-reference/system
GET /health
Check API health and system status
```bash cURL theme={null}
curl --request GET \
--url 'https://app.codethreat.com/api/v1/health'
```
# Violations
Source: https://codethreat.mintlify.app/api-reference/violations
GET /violations
Get a paginated list of security violations
# Violations API
Access and manage security violations via API.
## List Violations
```http theme={null}
GET /v1/violations?repository_id=repo_123&severity=critical,high
```
**Response**:
```json theme={null}
{
"violations": [
{
"violation_id": "vio_789",
"title": "SQL Injection in user_controller.py",
"severity": "CRITICAL",
"cvss_score": 9.1,
"epss_score": 68.5,
"type": "SAST",
"status": "OPEN",
"file_path": "api/user_controller.py",
"line_number": 45
}
],
"pagination": {
"page": 1,
"total": 27
}
}
```
## Get Violation Details
```http theme={null}
GET /v1/violations/:violation_id
```
**Response**:
```json theme={null}
{
"violation_id": "vio_789",
"title": "SQL Injection in user_controller.py",
"description": "User input directly interpolated into SQL query...",
"severity": "CRITICAL",
"cvss_score": 9.1,
"epss_score": 68.5,
"type": "SAST",
"cwe": "CWE-89",
"status": "OPEN",
"file_path": "api/user_controller.py",
"line_number": 45,
"code_snippet": "query = f\"SELECT * FROM users WHERE id = {user_id}\"",
"remediation": "Use parameterized queries...",
"first_detected": "2024-03-10T08:15:00Z",
"last_seen": "2024-03-15T14:35:42Z"
}
```
## Update Violation Status
```http theme={null}
POST /v1/violations/:violation_id/suppress
```
**Request**:
```json theme={null}
{
"justification": "Input validated on line 42 before use"
}
```
## What's Next?
Trigger scans
Manage repositories
# API Keys
Source: https://codethreat.mintlify.app/automation/api-keys
Create and manage API keys for programmatic access
Create API keys to access CodeThreat programmatically via REST API.
## Create API Key
**Organization Settings** β **API Keys**
Click **Create API Key**
Set key properties:
* **Name**: Descriptive name (e.g., "CI/CD Pipeline")
* **Scopes**: Permissions (read:scans, write:scans, etc.)
* **Expiration**: Optional expiration date
Click **Generate Key**
Copy API key immediately
You won't see the key again. Store securely.
## API Key Scopes
API keys use a scope-based permission system with the format `{resource}:{action}`:
**Organization**:
* `organization:read` - View organization details
* `organization:write` - Modify organization settings
* `organization:manage` - Full organization management
**Repositories**:
* `repository:read` - View repositories
* `repository:write` - Modify repository settings
* `repository:manage` - Full repository management
**Scans**:
* `scan:read` - View scan results
* `scan:write` - Trigger and manage scans
* `scan:manage` - Full scan management
**Violations**:
* `violation:read` - View violations
* `violation:write` - Update violation status
* `violation:manage` - Full violation management
**Users**:
* `user:read` - View user information
* `user:write` - Modify user settings
* `user:manage` - Full user management
**Integrations**:
* `integration:read` - View integrations
* `integration:write` - Manage integrations
**API Keys**:
* `api-key:read` - View API keys
* `api-key:write` - Create/revoke API keys
**Webhooks**:
* `webhook:read` - View webhook configurations
* `webhook:write` - Manage webhooks
Use principle of least privilegeβgrant only required scopes.
## Using API Keys
Include API key in X-API-Key header:
```bash theme={null}
curl -X GET "https://app.codethreat.com/api/v1/scans" \
-H "X-API-Key: YOUR_API_KEY"
```
[View full API documentation β](/api-reference/authentication)
## Rotate API Keys
Regularly rotate API keys for security:
1. Create new API key
2. Update services to use new key
3. Test new key
4. Delete old key
## Best Practices
**Rotate keys regularly**: Every 90 days
**Use key per service**: Separate keys for each integration
**Set expiration dates**: Automatic key expiration
**Monitor usage**: Review API key activity logs
**Store securely**: Use secret management tools
**Revoke immediately**: Delete compromised keys
## What's Next?
View API documentation
Integrate with CI/CD
# CI/CD Integration
Source: https://codethreat.mintlify.app/automation/ci-cd-integration
Integrate CodeThreat into your CI/CD pipeline
Integrate security scanning into your continuous integration and deployment pipelines.
## Benefits
Catch vulnerabilities before deployment
No manual intervention needed
Block builds with security issues
Same security checks every build
## GitHub Actions
```yaml theme={null}
name: CodeThreat Security Scan
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: CodeThreat Scan
uses: codethreat/scan-action@v1
with:
api-key: ${{ secrets.CODETHREAT_API_KEY }}
fail-on: critical,high
```
## GitLab CI
```yaml theme={null}
codethreat_scan:
stage: security
script:
- curl -X POST "https://app.codethreat.com/api/v1/scans" \
-H "X-API-Key: $CODETHREAT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"repository_id": "$CI_PROJECT_ID"}'
only:
- main
- merge_requests
```
## Azure Pipelines
```yaml theme={null}
trigger:
- main
pool:
vmImage: 'ubuntu-latest'
steps:
- task: CodeThreatScan@1
inputs:
apiKey: '$(CodeThreatApiKey)'
failOnCritical: true
```
## Jenkins
```groovy theme={null}
pipeline {
agent any
stages {
stage('Security Scan') {
steps {
sh '''
curl -X POST "https://app.codethreat.com/api/v1/scans" \
-H "X-API-Key: ${CODETHREAT_API_KEY}" \
-H "Content-Type: application/json" \
-d '{"repository_id": "repo_123"}'
'''
}
}
}
}
```
## Best Practices
**Create dedicated API key**: Use separate key for CI/CD
**Store securely**: Use secret management (GitHub Secrets, etc.)
**Fail on Critical/High**: Block builds with serious issues
**Run on every push**: Continuous security checking
**Cache results**: Speed up builds with caching
**Parallel execution**: Run security scan in parallel with tests
## What's Next?
Create API keys for CI/CD
View API documentation
# Webhooks
Source: https://codethreat.mintlify.app/automation/webhooks
Receive real-time notifications of CodeThreat events
Configure webhooks to receive real-time notifications when events occur in CodeThreat.
## Create Webhook
**Organization Settings** β **Webhooks**
Click **Create Webhook**
Set webhook properties:
* **URL**: Your endpoint URL
* **Events**: Which events to receive
* **Secret**: Optional signing secret
Click **Create**
## Available Events
**scan.completed**: Scan finished
**scan.failed**: Scan encountered error
**violation.created**: New violation found
**violation.fixed**: Violation marked as fixed
**repository.connected**: Repository added
**member.invited**: Team member invited
**member.added**: Team member joined
## Webhook Payload
Example payload:
```json theme={null}
{
"event": "scan.completed",
"timestamp": "2024-03-15T14:32:18Z",
"data": {
"scan_id": "scan_123",
"repository": "myapp",
"status": "COMPLETED",
"violations": {
"critical": 2,
"high": 5,
"medium": 12,
"low": 8
}
}
}
```
## Verify Webhook Signatures
Verify webhooks using HMAC signature:
```python theme={null}
import hmac
import hashlib
def verify_signature(payload, signature, secret):
expected = hmac.new(
secret.encode(),
payload.encode(),
hashlib.sha256
).hexdigest()
return hmac.compare_digest(expected, signature)
```
## What's Next?
Create API keys
Integrate with CI/CD
# Benchmarks
Source: https://codethreat.mintlify.app/benchmarks/overview
Performance and accuracy metrics coming soon
Benchmarks Coming Soon
We're preparing comprehensive benchmark data comparing CodeThreat's autonomous AppSec platform against traditional security tools.
***
## What's Coming
We're working on detailed benchmarks that will showcase:
Precision, recall, and false positive rates across vulnerability types
Performance benchmarks across codebase sizes and languages
How teams reduced false positives by 90% and accelerated security
ROI calculations and engineering time saved
***
## Try It Yourself
Experience autonomous agents on your code
Get scanning in under 5 minutes
# Blog
Source: https://codethreat.mintlify.app/blog/autonomous-appsec
Insights and updates from the CodeThreat team
Blog Coming Soon
We're crafting deep insights on autonomous AppSec, AI-powered security analysis, and the future of application security.
***
## What to Expect
Our upcoming blog will cover:
How AI agents are transforming application security
Under the hood of agentic SAST and vulnerability detection
Trends in DevSecOps and the evolution of security tooling
Real-world impact of autonomous security at scale
***
## Stay Updated
Connect with security engineers and stay updated on our latest content
# v2.0.0
Source: https://codethreat.mintlify.app/changelog/v2-0-0
Initial Major Release - Autonomous AppSec Platform
## October 2024
π Initial Major Release
### Introducing Autonomous AppSec
CodeThreat v2.0 represents a fundamental shift in application securityβfrom rule-based pattern matching to autonomous, AI-powered security engineering.
***
### Core Platform
**Agentic SAST**
Revolutionary static analysis powered by specialized AI agents that understand context, not just patterns.
* Multi-agent system with specialized security analysis agents
* LLM-powered contextual vulnerability detection
* Framework-aware analysis (React, Django, Flask, Spring Boot, and more)
* Business logic vulnerability detection
* 90% fewer false positives vs traditional SAST
**Multi-Engine Security Scanning**
Comprehensive security coverage with autonomous precision across all detection types.
* **SAST**: Advanced static code analysis with AI-powered context
* **SCA**: Dependency vulnerability scanning with exploitability assessment
* **Secrets**: Credential and token detection with entropy analysis
* **IaC**: Infrastructure security for Terraform, CloudFormation, Kubernetes
**Language Support**
Production-ready coverage for the most popular languages and frameworks.
* JavaScript/TypeScript, Python, Java, C#, Go, Ruby, PHP
* React, Angular, Vue.js, Node.js, Express, FastAPI, Django, Flask
* Spring Boot, .NET Core, Rails, Laravel
***
### Developer Experience
**Seamless Integrations**
Native integrations with your existing workflowβzero friction.
* GitHub, GitLab, Azure DevOps, Bitbucket Cloud & Server
* Automated PR scanning with inline comments
* CI/CD pipeline integration (GitHub Actions, GitLab CI, Jenkins, CircleCI)
* IDE plugins (VS Code, IntelliJ IDEA, JetBrains suite)
**AI-Powered Pull Request Reviews**
Autonomous security reviews that developers actually trust.
* Automated vulnerability detection on every PR
* Contextual AI analysis with actionable remediation guidance
* GitHub Checks integration with pass/fail status
* Inline code suggestions for secure fixes
**Intelligent Findings Management**
Security findings that matter, with AI-driven prioritization.
* Exploitability-based severity scoring
* Contextual false positive elimination
* One-click remediation suggestions
* Violation status tracking and triage workflows
***
### Security Dashboard
**Real-time Security Metrics**
Crystal-clear visibility into your security posture.
* Security trends and analytics across repositories
* Vulnerability heat maps by severity and type
* Team performance and remediation metrics
* Compliance reporting and audit trails
**Advanced Filtering & Search**
Find what matters, fast.
* Filter by severity, status, repository, language, scan type
* Saved searches and custom views
* Bulk actions for efficient triage
* Export capabilities (JSON, SARIF, CSV, XML)
***
### Automation & API
**Webhooks**
Real-time notifications for security events.
* Scan completion, new violations, status changes
* Configurable payloads and retry logic
* Integration with Slack, PagerDuty, Jira
**REST API**
Comprehensive API for custom integrations and automation.
* Full programmatic access to scans, violations, and repositories
* Organization and team management
* Detailed API documentation with interactive examples
* Multiple export formats (JSON, SARIF, CSV, XML, JUnit)
**CLI Tool**
Powerful command-line interface for local and CI/CD workflows.
* Run scans locally or in pipelines
* Real-time scan progress monitoring
* Flexible output formats and filtering
* Cross-platform support (Linux, macOS, Windows)
***
### Team Management
Granular access control and collaboration.
* Role-based permissions (Admin, Developer, Viewer)
* Repository-level access control
* Team invitation and member management
* Comprehensive audit logs
**Custom Configuration**
Tailor CodeThreat to your security policies.
* Custom rule configuration and suppression
* Project-specific security settings
* Agent behavior customization
* Threshold-based scan policies
***
### Performance & Scale
**Built for Speed**
Enterprise-grade performance that doesn't slow you down.
* Average scan time: 2-8 minutes for 100K LOC
* Incremental scanning for faster feedback
* Parallel scan execution
* Optimized for monorepos and microservices
**Scalable Architecture**
Production-ready infrastructure for teams of any size.
* Multi-tenant cloud architecture
* 99.9% uptime SLA
* Global CDN for fast dashboard access
* Elastic scan worker pools
***
### Compliance & Security
**Standards Support**
Meet regulatory requirements with confidence.
* OWASP Top 10 coverage
* CWE mapping for all findings
* SARIF output for security tools integration
* SOC 2 Type II compliant infrastructure
**Data Privacy**
Your code stays yours.
* End-to-end encryption for code in transit
* No persistent storage of source code
* GDPR compliant data handling
***
### What's Next
This is just the beginning. Our roadmap includes:
Automatic vulnerability remediation via AI-generated PRs
Continuous model improvements and fine-tuning capabilities
Real-time threat feeds integrated with code analysis
Rust, Kotlin, Swift, and Scala analysis
***
## Getting Started
Get scanning in under 5 minutes
Detailed setup instructions
Explore the REST API
Connect with other users
***
**Thank you** for being part of the autonomous AppSec revolution. We're excited to help you build more secure applications with less noise and more precision.
# AI-Powered Analysis
Source: https://codethreat.mintlify.app/concepts/ai-powered-analysis
How CodeThreat uses AI to improve security accuracy
CodeThreat's AI analyzes your code with the same understanding a security engineer would haveβconsidering context, patterns, and actual exploitability.
## The False Positive Problem
Traditional security tools generate overwhelming noise:
* 50-70% of SAST findings are false positives
* Security teams spend more time investigating than fixing
* Developers ignore alerts due to alert fatigue
* Real vulnerabilities get lost in noise
CodeThreat's AI solves this by:
* Analyzing code context automatically
* Filtering out non-exploitable findings
* Learning your codebase patterns
* Prioritizing real security issues
***
## How the AI Engine Works
CodeThreat Hive is the AI engine that powers intelligent analysis:
The AI builds a map of your repository structure, understanding relationships between files, functions, and data flows.
For each violation, the AI examines code patterns, input validation, framework controls, and dataflow.
The AI determines if a violation is actually exploitable or a false positive based on context.
The AI remembers patterns specific to your repository and improves filtering over time.
### Powered by Large Language Models
CodeThreat uses state-of-the-art LLMs (GPT-4, Claude) combined with RepoMap technology:
* **Semantic understanding**: Knows what code does, not just what it says
* **Cross-file analysis**: Tracks data flow across multiple files
* **Framework awareness**: Understands security controls in React, Django, Spring, etc.
* **Context-aware**: Considers the full execution path
***
## False Positive Elimination
After every scan, the AI automatically analyzes violations to filter false positives.
### What the AI Checks
**Question**: Is user input properly validated before use?
The AI recognizes validation patterns and understands when SQL injection risk is mitigated.
**Question**: Does the framework provide built-in protection?
The AI recognizes React auto-escaping, Django ORM parameterization, and other framework protections.
**Question**: Is this code actually executed?
The AI understands control flow and identifies unreachable code.
### Results of AI Filtering
After AI analysis, violations are marked:
* β
**Reviewed by AI**: The AI examined this and determined it's real
* β οΈ **Likely False Positive**: The AI thinks this isn't exploitable
* π **Needs Human Review**: The AI couldn't determine automatically
***
## AI Pull Request Reviews
CodeThreat's AI reviews every pull request for security implications.
### What the AI Reviews
* Security impact analysis
* Contextual fix suggestions
* Priority and confidence ratings
* Architectural impact assessment
### Benefits
* **Faster code reviews**: Security feedback before merge
* **Consistent analysis**: Same quality review on every PR
* **Contextual fixes**: Suggestions tailored to your codebase
* **No human intervention**: Agents work autonomously
***
## Learning and Improvement
The AI learns from your codebase:
* **Pattern recognition**: Identifies your validation patterns
* **Framework usage**: Understands how you use frameworks
* **False positive patterns**: Learns what you consider false positives
* **Continuous improvement**: Gets better with each scan
***
## Next Steps
Enable autonomous investigation
Set up AI PR reviews
# Custom Rules
Source: https://codethreat.mintlify.app/configuration/custom-rules
Create organization-specific security rules
Create custom security rules tailored to your organization's policies and coding standards.
## Rule Types
### Pattern-Based Rules
Simple regex and AST pattern matching for common anti-patterns.
```yaml theme={null}
rules:
- id: custom-001
name: Hardcoded Internal API
description: Internal API URLs should use environment variables
severity: high
category: configuration
patterns:
- pattern: 'https?://internal\.company\.com'
type: regex
message: "Hardcoded internal API URL detected"
paths:
include: ["**/*.js", "**/*.ts"]
exclude: ["**/*.test.*"]
remediation: |
Use environment variables:
const API_URL = process.env.INTERNAL_API_URL;
```
### Semantic Rules
AI-powered rules that understand code context.
```yaml theme={null}
rules:
- id: custom-002
name: Missing Authorization Check
description: Public API endpoints must verify permissions
severity: critical
type: semantic
rule_prompt: |
Check if function is:
1. API endpoint handler
2. Publicly accessible
3. Performs data modification
4. Missing authorization checks
Flag if all conditions met.
```
***
## Rule Structure
```yaml theme={null}
rules:
- id: unique-rule-id
name: Rule Name
description: Description
severity: critical | high | medium | low
category: category-name
type: pattern | semantic
patterns: [] # For pattern rules
rule_prompt: "" # For semantic rules
paths:
include: []
exclude: []
remediation: ""
```
***
## Best Practices
* Start with simple pattern-based rules
* Provide clear remediation guidance
* Test rules thoroughly before deploying
* Store rules in version control
* Review and update quarterly
***
## Next Steps
Configure project settings
Manage rules via API
# Project Settings
Source: https://codethreat.mintlify.app/configuration/project-settings
Configure CodeThreat for your project
## Project Configuration
Configure CodeThreat settings for your repositories through the dashboard.
Project-specific settings are managed in the repository settings page. Organization-wide defaults can be configured in organization settings.
***
## Available Settings
### Scan Configuration
Configure which security checks run for your repository:
* **SAST**: Static application security testing
* **SCA**: Software composition analysis
* **Secrets**: Credential and token detection
* **IaC**: Infrastructure as code security
### Scan Triggers
Configure when scans run automatically:
* **On push**: Scan main branch on every push
* **On pull request**: Scan PRs automatically
* **Scheduled**: Run scans on a schedule
### File Exclusions
Exclude files or directories from scanning:
* Test files and directories
* Build artifacts
* Dependencies (node\_modules, vendor, etc.)
* Configuration files
***
## Configuration Hierarchy
Settings are applied in the following order:
1. **Organization defaults** - Set in organization settings
2. **Repository settings** - Configured per repository
3. **Scan settings** - Override for specific scans
***
## Best Practices
Begin with stricter settings and adjust based on results
Exclude dist, build, and node\_modules directories
***
## Next Steps
Create organization-specific security rules
Add CodeThreat to your pipeline
# Managing False Positives
Source: https://codethreat.mintlify.app/findings/false-positives
Identify, suppress, and reduce false positive security findings
False positives are security findings that aren't actually vulnerabilities. Learn how to identify and manage them effectively.
## What Are False Positives?
A false positive is a violation reported by security tools that isn't actually exploitable or doesn't represent a real security risk.
### Common Causes
Input is validated but tool doesn't recognize the pattern
Framework provides automatic protection but tool doesn't know
Security rules flag test/mock code
Tool lacks context about how code is used
***
## Examples
### Framework Auto-Escaping
```javascript theme={null}
// Reported as XSS vulnerability
function UserProfile({ userName }) {
return {userName}
;
}
```
**Why false positive**: React automatically escapes JSX expressions. Not vulnerable to XSS.
### Input Validation
```python theme={null}
# Reported as SQL injection
def get_user(user_id):
if not user_id.isdigit():
raise ValueError("Invalid user ID")
query = f"SELECT * FROM users WHERE id = {user_id}"
```
**Why false positive**: `user_id` validated to contain only digits. SQL injection impossible.
***
## Identifying False Positives
Ask these questions:
* **Is input validated?** Check if input is validated before reaching the sink
* **Does framework protect?** Check if framework provides automatic protection
* **Is this production code?** Check if code is in test/mock directories
* **Is context different?** Consider full execution path and infrastructure protections
Be conservative when marking false positives. When in doubt, consult security experts or treat as real until proven otherwise.
***
## AI-Powered False Positive Elimination
CodeThreat's AI automatically analyzes violations to identify false positives.
### How AI Helps
AI examines full code context, not just flagged line
AI traces data from source to sink across files
AI recognizes framework-specific security controls
AI learns your codebase patterns and improves over time
AI marks likely false positives with justification
### Enable AI Filtering
**Repository** β **Settings** β **AI Features**
Toggle **False Positive Elimination** to enabled
Choose filtering level:
* **Conservative**: Only obvious false positives
* **Balanced**: Default (recommended)
* **Aggressive**: Filter more aggressively
Save settings and trigger new scan
***
## Manual Suppression
When AI doesn't catch a false positive, manually suppress it.
### How to Suppress
Click the false positive violation
Click **Suppress** button
**Required**: Explain why this is a false positive
Good examples:
* "Input validated on line 42 with regex `^[0-9]+$` before use"
* "React automatically escapes JSX expressions, not vulnerable to XSS"
* "Test code using mock credentials, not production secret"
Bad examples:
* "False positive" (not specific)
* "This is fine" (no explanation)
* "Low priority" (not a justification)
Click **Suppress** to save
### Suppression Best Practices
* **Be specific**: Explain exactly why it's a false positive
* **Reference code**: Mention line numbers or functions
* **Provide evidence**: Link to framework documentation if relevant
* **Review periodically**: Revisit suppressions when code changes
* **Don't suppress to hit metrics**: Only suppress genuine false positives
Suppression justifications help the AI learn. Detailed explanations improve future false positive filtering.
***
## Bulk Suppression
Suppress multiple similar false positives at once:
1. Filter violations to show only those you want to suppress
2. Select violations using checkboxes
3. Click **Bulk Actions** β **Suppress Selected**
4. Provide justification
5. Review count and click **Suppress All**
***
## Reviewing Suppressions
Periodically review suppressions to ensure they're still valid:
1. Filter by **Status = Suppressed**
2. Sort by date suppressed (oldest first)
3. Read suppression justifications
4. Verify they're still valid
5. Unsuppress if code changed or justification invalid
***
## Best Practices
* Enable AI false positive elimination
* Provide detailed suppression justifications
* Review suppressions quarterly
* Don't suppress to game metrics
* Focus on prevention over suppression
***
## Next Steps
Learn about autonomous investigation
Complete violation workflow
# Managing Violations
Source: https://codethreat.mintlify.app/findings/managing-violations
Triage, assign, fix, and track security violations
Effective violation management ensures security issues get fixed quickly.
## Workflow
Review violations, assess severity and priority
Assign to team members responsible for fixing
Developer fixes the vulnerability
Re-scan confirms violation is fixed
Monitor metrics and trends
***
## Triaging Violations
When new violations appear, triage them quickly.
### Triage Checklist
* **Assess severity**: Critical/High/Medium/Low?
* **Check EPSS**: Is it actively being exploited?
* **Identify ownership**: Who should fix this?
* **Determine priority**: When should this be fixed?
* **Validate**: Real vulnerability or false positive?
### Triage Actions
Assign to team member who:
* Owns the affected code
* Has expertise in vulnerability type
* Is working on related changes
Mark as suppressed if:
* Confirmed false positive
* Accepted business risk
* Test/mock code
* Already mitigated at infrastructure level
Escalate if:
* Critical vulnerability in production
* Actively exploited (high EPSS)
* No clear owner
* Requires architectural changes
***
## Assigning Violations
### How to Assign
Click the violation to assign
Click **Assign** in violation detail view
Select team member from dropdown
Provide context or priority
Set deadline based on severity:
* Critical: Today
* High: Within 1 week
* Medium: Within 1 month
* Low: Backlog
### Best Practices
* Assign based on code ownership
* Limit violations per person
* Use due dates for urgency
* Notify assignee via comment or Slack
* Balance security work with features
***
## Fixing Violations
### Fix Workflow
Read violation description and remediation guidance
Understand the vulnerable code path
Apply recommended remediation
Verify fix doesn't break functionality
Commit and push fix with violation ID
Trigger new scan or wait for automated scan
Confirm violation is marked as FIXED
### Example: Fixing SQL Injection
**Vulnerable**:
```python theme={null}
def get_user(user_id):
query = f"SELECT * FROM users WHERE id = {user_id}"
return db.execute(query)
```
**Fixed**:
```python theme={null}
def get_user(user_id):
query = "SELECT * FROM users WHERE id = ?"
return db.execute(query, (user_id,))
```
***
## Suppressing Violations
Change violation status when it's not a real security issue or is accepted risk.
### FALSE\_POSITIVE Status
Use for violations that aren't real security issues:
* Genuine false positives
* Test/mock code
* Framework provides protection
* Not exploitable in context
### ACCEPTED\_RISK Status
Use when vulnerability is real but risk is accepted:
* Business decision to accept risk
* Mitigated by compensating controls
* Fix would break critical functionality
* Temporary acceptance with fix deadline
Never suppress real vulnerabilities as FALSE\_POSITIVE to improve metrics. Integrity matters more than perfect scores.
***
## Bulk Actions
Manage multiple violations at once:
* **Bulk assign**: Assign multiple violations to team member
* **Bulk suppress**: Mark multiple false positives
* **Bulk link**: Link to Jira/GitHub issues
* **Bulk export**: Export violations for reporting
***
## Violation Statuses
* **OPEN**: Active violation requiring action
* **FIXED**: Vulnerability has been fixed
* **FALSE\_POSITIVE**: Not a real security issue
* **ACCEPTED\_RISK**: Real vulnerability, risk accepted
***
## Best Practices
* Triage violations within 24 hours
* Assign critical violations immediately
* Set realistic due dates
* Track violation metrics
* Review suppressions quarterly
* Don't suppress to game metrics
***
## Next Steps
Learn about violation structure
Identify and suppress false positives
# Understanding Violations
Source: https://codethreat.mintlify.app/findings/understanding-violations
What violations are and how they're tracked
A violation is a security finding detected during a scan. Understanding how violations work helps you manage and fix security issues effectively.
## What is a Violation?
A violation represents a specific security issue in your code:
Specific file, line number, and code snippet
CRITICAL, HIGH, MEDIUM, LOW, or INFO
SAST, AGENTIC\_SAST, SCA, SECRET, or IAC
OPEN, FIXED, FALSE\_POSITIVE, ACCEPTED\_RISK
***
## Violation Information
Every violation includes:
### Identification
* **ID**: Unique identifier (e.g., `VIO-2024-001234`)
* **Hash**: Fingerprint for deduplication
* **Rule ID**: Detection rule that found it
### Location
* **File path**: Where the issue exists
* **Line number**: Exact location in code
* **Code snippet**: Context around the issue
* **Repository**: Which repo contains it
* **Branch**: Which branch it was found on
### Classification
* **Type**: SAST, AGENTIC\_SAST, SCA, SECRET, or IAC
* **Category**: Injection, XSS, Crypto, etc.
* **CWE**: Common Weakness Enumeration (e.g., CWE-89)
* **CVE**: For dependency vulnerabilities
### Severity Assessment
* **Severity level**: CRITICAL, HIGH, MEDIUM, LOW, INFO
* **CVSS score**: Technical severity (0-10)
* **EPSS score**: Exploitation probability (0-100%)
### Status and Lifecycle
* **Status**: OPEN, FIXED, FALSE\_POSITIVE, ACCEPTED\_RISK
* **First detected**: When first found
* **Last seen**: Most recent scan showing it
* **Reviewed by AI**: Whether AI analyzed it
***
## Violation Types
### SAST Violations
Code-level vulnerabilities in your source code.
**Example**: SQL injection in user controller
**Characteristics**:
* Location: Specific code line
* Fix: Change code implementation
* Persistent: Remains until code is fixed
### SCA Violations
Vulnerabilities in dependencies and third-party libraries.
**Example**: CVE-2024-1234 in lodash package
**Characteristics**:
* Location: Package manifest
* Fix: Update dependency version
* May affect multiple locations
### Secret Violations
Exposed credentials and sensitive data.
**Example**: Hardcoded API key in config file
**Characteristics**:
* Location: Any file containing secret
* Fix: Remove secret, use environment variable, rotate credential
* Critical: Even after removal, secret may be in Git history
### IaC Violations
Misconfigurations in infrastructure-as-code.
**Example**: Public S3 bucket configuration
**Characteristics**:
* Location: Infrastructure definition files
* Fix: Update IaC configuration
* Preventive: Catches issues before deployment
***
## Violation Lifecycle
Violations move through states:
1. **OPEN**: New violation detected
2. **FIXED**: Vulnerability has been fixed
3. **FALSE\_POSITIVE**: Not a real security issue
4. **ACCEPTED\_RISK**: Real vulnerability, risk accepted
***
## Next Steps
Triage and fix violations
Identify and manage false positives
# Installation
Source: https://codethreat.mintlify.app/installation
Deploy CodeThreat in SaaS or on-premise environments
CodeThreat offers flexible deployment to meet your security and infrastructure requirements.
## Deployment Options
Fastest setup with zero infrastructure management
Full control within your infrastructure
***
## SaaS Deployment
Get started immediately with our managed cloud platform.
### Requirements
* Modern web browser
* GitHub, GitLab, or Bitbucket account
* Admin access to repositories you want to scan
### Setup Steps
Sign up at [app.codethreat.com/signup](https://app.codethreat.com/signup)
Set up your organization settings and invite team members
Authorize CodeThreat to access your repositories
We only request the minimum permissions needed for security scanning. Read our [security practices](https://codethreat.com/security) for details.
```bash theme={null}
npm install -g @codethreat/cli
# or
pip install codethreat-cli
```
***
## On-Premise Deployment
Deploy CodeThreat within your own infrastructure for maximum control.
### System Requirements
**Docker**:
* CPU: 4+ cores
* RAM: 16GB minimum, 32GB recommended
* Storage: 100GB SSD
* Docker: 20.10+
* Docker Compose: 2.0+
**Kubernetes**:
* Kubernetes: 1.24+
* CPU: 8+ cores
* RAM: 32GB minimum
* Storage: 200GB persistent volume
* Ingress controller configured
### Docker Deployment
```bash theme={null}
docker pull codethreat/platform:latest
docker pull codethreat/agents:latest
docker pull codethreat/scanner:latest
```
Create a `docker-compose.yml` with database, Redis, platform, and agent services
```bash theme={null}
docker-compose up -d
```
```bash theme={null}
docker-compose exec platform codethreat init
```
### Kubernetes Deployment
```bash theme={null}
helm repo add codethreat https://charts.codethreat.com
helm repo update
```
Configure license, ingress, platform, agents, PostgreSQL, and Redis settings
```bash theme={null}
helm install codethreat codethreat/platform \
-f values.yaml \
--namespace codethreat \
--create-namespace
```
```bash theme={null}
kubectl get pods -n codethreat
kubectl logs -n codethreat -l app=codethreat-platform
```
***
## Post-Installation Configuration
### Configure Autonomous Agents
```bash theme={null}
codethreat config set agents.llm_provider openai
codethreat config set agents.model gpt-4
codethreat config set agents.contextual_analysis true
```
### Set Up Integrations
Configure your version control and CI/CD integrations:
GitHub App integration
GitLab webhook setup
Pipeline integration
### License Activation
**SaaS**: Your license is automatically activated upon signup. Visit [billing settings](https://app.codethreat.com/settings/billing) to manage your subscription.
**On-Premise**: Activate your license:
```bash theme={null}
codethreat license activate --key YOUR_LICENSE_KEY
```
Contact [sales@codethreat.com](mailto:sales@codethreat.com) for enterprise licensing.
***
## Verification
Confirm your installation is working:
```bash theme={null}
# Check platform status
codethreat status
# Run test scan
codethreat scan --project test-project --path ./sample-app
# View agent health
codethreat agents list
```
**Success!** You're ready to start securing your code.
***
## Next Steps
Follow the quickstart guide
Set up continuous scanning
# Azure DevOps Integration
Source: https://codethreat.mintlify.app/integrations/azure-devops
Connect Azure DevOps repositories to CodeThreat
Connect Azure DevOps to scan your repositories for security vulnerabilities.
## Connection Methods
**Best for**: Most users
* Full control over permissions
* Works with Azure DevOps Services and Server
* No OAuth setup required
**Requirements**: Azure DevOps access
**Best for**: Azure DevOps Services
* Quick authorization
* Automatic token management
* Cloud-only
**Requirements**: Azure DevOps Services account
***
## Personal Access Token Setup
Navigate to [dev.azure.com](https://dev.azure.com) and sign in
Click your profile icon (top right) β **Personal access tokens**
Click **+ New Token**
**Name**: `CodeThreat Security Scanner`
**Organization**: Select your organization
**Expiration**: Choose expiration date
**Scopes**: Select:
* β
**Code**: Read
* β
**Pull Requests**: Read
* β
**Project and Team**: Read
* β
**Service Hooks**: Read & write (for webhooks)
Click **Create** and copy the token immediately
**Settings** β **Integrations** β **Azure DevOps** β Select **Personal Access Token**
Paste token and enter organization name (from URL: `dev.azure.com/{organization}`)
Select repositories from your Azure DevOps projects
***
## Azure DevOps Server
CodeThreat supports on-premises Azure DevOps Server (formerly TFS).
### Requirements
* Azure DevOps Server 2019 or later
* Network connectivity to your server
* Valid SSL certificate
When connecting with PAT, enter your server URL:
```
https://devops.company.com/
```
***
## Webhook Configuration
CodeThreat creates service hooks in Azure DevOps for automated scanning.
### Service Hook Events
* **Code pushed**: Trigger scans on commits
* **Pull request created**: Scan new PRs
* **Pull request updated**: Rescan on PR changes
### Verify Service Hooks
1. In Azure DevOps: Project β **Project settings** β **Service hooks**
2. Find hooks with target URL: `https://app.codethreat.com/webhooks/azuredevops`
3. Click the hook β **Test** to verify delivery
***
## Pull Request Integration
Get security feedback in Azure DevOps pull requests.
### PR Status Checks
CodeThreat appears as a status check on PRs:
* β
**Succeeded**: No critical/high vulnerabilities
* β **Failed**: Security issues found
* β³ **Pending**: Scan in progress
### Branch Policies
Require CodeThreat checks before merging:
1. Azure DevOps Project β **Repos** β **Branches**
2. Select branch β **Branch policies**
3. **Status checks** β **Add status policy**
4. Select **CodeThreat Security Scan**
5. Set policy to **Required**
***
## Permissions
To connect Azure DevOps, you need:
* **Project Collection Administrator** (to create service hooks)
* Or **Project Administrator** (project-level connection)
***
## Best Practices
* Use organization-wide tokens
* Set token expiration (rotate every 90-180 days)
* Enable PR scanning
* Use branch policies to require security checks
***
## Troubleshooting
**Connection failed**:
* Verify token scopes are correct
* Check organization name matches Azure DevOps
* Ensure token hasn't expired
**Repositories not showing**:
* Verify you have Read access to repositories
* Check if project name filter is too restrictive
* Re-authorize the connection
**Service hooks not triggering**:
* Check service hook status in Azure DevOps
* Verify CodeThreat webhook URL is reachable
* Ensure firewall allows outbound HTTPS
***
## Next Steps
Start scanning Azure DevOps repositories
Get security feedback on pull requests
# Bitbucket Cloud Integration
Source: https://codethreat.mintlify.app/integrations/bitbucket-cloud
Connect Bitbucket Cloud repositories to CodeThreat
Connect Bitbucket Cloud to scan your repositories for security vulnerabilities.
## Connection Methods
**Best for**: Most users
* One-click authorization
* Workspace-level access
* Automatic token management
**Requirements**: Bitbucket Cloud account
**Best for**: Automation, restricted OAuth environments
* Alternative to main password
* Fine-grained permissions
* Revocable independently
**Requirements**: Bitbucket Cloud account
***
## OAuth Setup
**Settings** β **Integrations** β **Bitbucket** β **Connect with OAuth**
You'll be redirected to Bitbucket. Click **Grant access** to authorize
Choose which Bitbucket workspace to connect
Select repositories to scan and click **Import**
### OAuth Permissions
CodeThreat requests:
* `repository:read`: Read repository content
* `pullrequest:read`: Access pull requests
* `webhook`: Manage webhooks
***
## App Password Setup
Click your profile β **Personal settings** β **App passwords**
Click **Create app password**
**Label**: `CodeThreat Security Scanner`
**Permissions**: Select:
* β
**Repositories**: Read
* β
**Pull requests**: Read
* β
**Webhooks**: Read and write
Click **Create** and copy the password immediately
**Settings** β **Integrations** β **Bitbucket** β Select **App Password**
Enter your Bitbucket username and paste app password
Select repositories to scan
***
## Webhook Configuration
CodeThreat creates webhooks automatically for automated scanning.
### Webhook Events
* **Repository push**: Trigger scans on commits
* **Pull request created**: Scan new PRs
* **Pull request updated**: Rescan on changes
### Verify Webhooks
1. In Bitbucket: Repository β **Settings** β **Webhooks**
2. Find webhook pointing to: `https://app.codethreat.com/webhooks/bitbucket`
3. Click webhook β **View requests** to see delivery history
***
## Pull Request Integration
Get security feedback directly in Bitbucket pull requests.
### Enable PR Scanning
In CodeThreat repository settings:
* Auto-scan on PR: β Enabled
* AI PR reviews: β Enabled
* Post PR comments: β Enabled
### PR Build Status
CodeThreat updates pull request build status:
* β
**Successful**: No critical/high vulnerabilities
* β **Failed**: Security issues found
* β³ **In Progress**: Scanning
***
## Best Practices
* Use OAuth for simpler setup
* Connect at workspace level for teams
* Enable PR scanning
* Set merge checks to require security scans
***
## Troubleshooting
**Connection failed**:
* Verify app password permissions are correct
* Check username is your Bitbucket username (not email)
* Ensure workspace access granted (for OAuth)
**Repositories not showing**:
* Verify you have Read access to repositories
* Check workspace is correctly selected
* Re-authorize the connection
**Webhook not triggering**:
* Check webhook delivery history in Bitbucket
* Verify webhook is active
* Ensure outbound HTTPS is allowed
***
## Next Steps
Start scanning Bitbucket repositories
Get security feedback on pull requests
# Bitbucket Server Integration
Source: https://codethreat.mintlify.app/integrations/bitbucket-server
Connect Bitbucket Server (Data Center) repositories to CodeThreat
Connect self-hosted Bitbucket Server or Bitbucket Data Center to scan repositories for security vulnerabilities.
## Overview
Bitbucket Server integration supports:
* Bitbucket Server 7.0+
* Bitbucket Data Center 7.0+
* Personal Access Token authentication
* Webhook integration for automated scanning
***
## Connection Setup
In Bitbucket Server, click your profile β **Manage account** β **Personal access tokens**
Click **Create token**
**Token name**: `CodeThreat Security Scanner`
**Permissions**: Select:
* β
**Projects**: Read
* β
**Repositories**: Read
* β
**Admin**: (for webhook management)
Click **Create** and copy the token immediately
**Settings** β **Integrations** β **Bitbucket Server**
Enter your Bitbucket Server base URL (e.g., `https://bitbucket.company.com`)
Paste your Personal Access Token
Click **Connect**
Select repositories to scan from your Bitbucket Server instance
***
## Configuration
### Base URL Format
Enter your Bitbucket Server URL:
```
https://bitbucket.company.com
```
**Requirements**:
* Include protocol (https\://)
* No trailing slash
* No /scm or project paths
### SSL Certificate
If your Bitbucket Server uses a self-signed SSL certificate:
1. Provide the CA certificate to CodeThreat support
2. Or ensure a valid SSL certificate is configured
***
## Webhook Configuration
CodeThreat creates webhooks for automated scanning.
### Required Permissions
The Personal Access Token needs **Admin** permission to create webhooks.
### Webhook Events
* **Repository push**: Trigger scans on commits
* **Pull request opened**: Scan new PRs
* **Pull request updated**: Rescan on changes
### Verify Webhooks
1. In Bitbucket Server: Repository β **Settings** β **Webhooks**
2. Find webhook pointing to CodeThreat API endpoint
3. Webhook should show as **Enabled** with recent successful deliveries
***
## Pull Request Integration
Get security feedback in Bitbucket Server pull requests.
### PR Build Status
CodeThreat updates PR build status to show security scan results.
### PR Comments
Enable PR comments in repository settings to get:
* Inline security findings
* Overall security summary
* AI-generated suggestions
***
## Network Requirements
### Firewall Configuration
Ensure connectivity between CodeThreat and your Bitbucket Server:
**Outbound from Bitbucket Server**:
* Allow HTTPS to `app.codethreat.com` (webhooks)
**Inbound to Bitbucket Server**:
* Allow HTTPS from CodeThreat IP addresses (for repository access)
Contact support for CodeThreat IP addresses to whitelist.
### SSL/TLS
Bitbucket Server must use:
* TLS 1.2 or later
* Valid SSL certificate (or provide CA cert)
***
## Best Practices
* Use dedicated service account for CodeThreat integration
* Set token expiration per security policy
* Whitelist CodeThreat IP addresses in firewall
* Enable PR scanning
* Test webhook delivery
***
## Troubleshooting
**Connection failed**:
* Verify base URL is correct and reachable
* Check token permissions (Projects: Read, Repositories: Read, Admin)
* Ensure SSL certificate is valid
* Verify firewall allows outbound HTTPS from CodeThreat
**SSL certificate error**:
* Use a valid SSL certificate from a trusted CA
* Or provide your CA certificate to CodeThreat support
* Check certificate expiration
**Webhook delivery failing**:
* Verify firewall allows outbound HTTPS from Bitbucket Server
* Whitelist `app.codethreat.com` in firewall
* Check webhook delivery logs in Bitbucket Server
* Verify token has Admin permission
**Repositories not showing**:
* Verify token has Projects and Repositories read permissions
* Check service account has repository access
* Ensure repositories are not archived
***
## Next Steps
Start scanning Bitbucket Server repositories
Get security feedback on pull requests
# GitHub Integration
Source: https://codethreat.mintlify.app/integrations/github
Connect your GitHub repositories to CodeThreat
Connect your GitHub account to scan repositories for security vulnerabilities.
## Connection Methods
**Best for**: Organizations and teams
* Fine-grained repository access
* Higher API rate limits
* Better security with organization-level installation
* Easier permission management
**Requirements**: Organization admin to install app
**Best for**: Individual developers
* Fastest setup (one-click authorization)
* Automatic token refresh
* Good for personal accounts
**Requirements**: GitHub account access
**Best for**: Automation, CI/CD pipelines
* Fine-grained permission control
* Good for scripting and automation
* No OAuth redirect needed
**Requirements**: GitHub account with token creation ability
***
## GitHub App Setup
**Settings** β **Integrations** β **GitHub**
Click **Connect with GitHub App**
Choose personal account or organization
Choose all repositories or specific repos
Click **Install & Authorize**
Select repositories to import for scanning
### GitHub App Permissions
| Permission | Access Level | Why We Need It |
| ------------------- | ------------ | ------------------------------------ |
| Repository contents | Read | To scan code for vulnerabilities |
| Pull requests | Read & Write | To scan PRs and post review comments |
| Checks | Write | To show pass/fail status on PRs |
| Webhooks | Read & Write | To receive push and PR notifications |
CodeThreat never pushes commits or modifies repository files, even though "Write" access is granted for PR comments and checks.
***
## OAuth Setup
**Settings** β **Integrations** β **GitHub** β **Connect with OAuth**
Review permissions and click **Authorize CodeThreat**
Grant access to organizations if applicable
Select repositories to scan
***
## Personal Access Token Setup
GitHub β **Settings** β **Developer settings** β **Personal access tokens** β **Generate new token (classic)**
Set note: `CodeThreat Security Scanner`
Select scopes:
* β
`repo` (Full control of private repositories)
* β
`read:org` (Read org membership)
* β
`admin:repo_hook` (Full control of webhooks)
Click **Generate token** and copy immediately
**Settings** β **Integrations** β **GitHub** β **Connect with Token**
Paste token and click **Connect**
***
## Webhook Configuration
CodeThreat automatically creates webhooks for selected repositories:
* **Push events**: Trigger scans on code changes
* **Pull request events**: Scan PRs automatically
* **Workflow events**: Detect CI/CD changes
Webhook URL: `https://app.codethreat.com/webhooks/github`
***
## Troubleshooting
### Webhook Not Receiving Events
* Verify webhook URL is correct
* Check webhook is active in GitHub settings
* Ensure repository has webhook configured
* Check firewall allows GitHub webhooks
### Rate Limit Issues
* Use GitHub App for higher rate limits (15,000/hour vs 5,000/hour)
* Reduce scan frequency for large repositories
* Contact support for enterprise rate limits
### Permission Errors
* Verify token has correct scopes
* Check organization OAuth app policy
* Ensure repository access is granted
***
## Next Steps
Configure automatic scans
Set up PR security reviews
# GitLab Integration
Source: https://codethreat.mintlify.app/integrations/gitlab
Connect your GitLab projects to CodeThreat
Connect GitLab to scan your projects for security vulnerabilities. Works with both GitLab.com and self-hosted GitLab instances.
## Connection Methods
**Best for**: GitLab.com users
* One-click authorization
* Automatic token management
* Works with GitLab Cloud
**Requirements**: GitLab.com account
**Best for**: Self-hosted GitLab, automation
* Works with self-hosted GitLab
* Fine-grained permissions
* No browser redirect needed
**Requirements**: Ability to create tokens
***
## OAuth Setup (GitLab.com)
**Settings** β **Integrations** β **GitLab** β **Connect with OAuth**
You'll be redirected to GitLab. Click **Authorize** to grant access
Select projects to scan and click **Import**
### OAuth Permissions
CodeThreat requests:
* `read_user`: Read user profile
* `read_repository`: Read repository content
* `read_api`: Access GitLab API (read-only)
* `api`: Webhook management
***
## Personal Access Token Setup
GitLab β **Preferences** β **Access Tokens**
Fill in token details:
**Token name**: `CodeThreat Security Scanner`
**Expiration date**: Choose expiration (optional)
**Scopes**: Select:
* β
`read_api`: Read-only API access
* β
`read_repository`: Read repository content
* β
`write_repository`: Webhook management
Click **Create personal access token** and copy immediately
**Settings** β **Integrations** β **GitLab** β Select **Personal Access Token**
Paste token and for self-hosted GitLab, enter base URL (e.g., `https://gitlab.company.com`)
Select projects to scan and import them
***
## Self-Hosted GitLab
CodeThreat supports self-hosted GitLab instances (GitLab CE and EE).
### Requirements
* GitLab 13.0 or later
* Network connectivity from CodeThreat to your GitLab instance
* Valid SSL certificate
When adding a Personal Access Token, enter your GitLab base URL:
```
https://gitlab.company.com
```
Ensure no trailing slash, includes protocol (https\://), and is accessible from CodeThreat.
***
## Webhook Configuration
CodeThreat automatically creates webhooks for automated scanning.
### Webhook Events
* **Push events**: Trigger scans on commits
* **Merge request events**: Scan MRs automatically
* **Tag events**: Scan tagged releases
### Verify Webhooks
1. In GitLab: Project β **Settings** β **Webhooks**
2. Find webhook pointing to: `https://app.codethreat.com/webhooks/gitlab`
3. Click **Test** β **Push events** to verify delivery
***
## Merge Request Integration
Get security feedback directly in GitLab merge requests.
### Enable MR Scanning
In CodeThreat repository settings:
* Auto-scan on MR: β Enabled
* AI MR reviews: β Enabled
* Post MR comments: β Enabled
### MR Comments
CodeThreat posts:
* Summary comment with overall security status
* Inline comments on specific vulnerabilities
* AI-generated security suggestions
***
## Best Practices
* Use OAuth for GitLab.com
* Rotate PATs periodically (every 90 days)
* Enable merge request scanning
* Monitor webhook delivery
***
## Troubleshooting
**Connection failed**:
* Verify token has correct scopes
* Check base URL for self-hosted GitLab
* Ensure GitLab instance is reachable
**Projects not showing**:
* Verify you have at least Developer access
* Check project visibility
* Re-authorize the connection
**Webhook not triggering**:
* Check webhook delivery in GitLab project settings
* Verify webhook is active
* Ensure firewall allows outbound HTTPS
***
## Next Steps
Start scanning your GitLab projects
Get security feedback on merge requests
# Integrations Overview
Source: https://codethreat.mintlify.app/integrations/overview
Connect CodeThreat to your version control system
CodeThreat integrates with all major version control systems to scan your repositories for security vulnerabilities.
## Supported Platforms
GitHub Cloud with OAuth, GitHub App, or Personal Access Token
GitLab Cloud and Self-Hosted with OAuth or Personal Access Token
Azure DevOps with OAuth or Personal Access Token
Bitbucket Cloud with OAuth or App Passwords
Bitbucket Server (Data Center) with Personal Access Tokens
***
## Connection Methods
Different platforms support different authentication methods:
| Platform | OAuth | GitHub App | Personal Access Token | App Password |
| -------------------- | ----- | ---------- | --------------------- | ------------ |
| **GitHub** | β
| β
| β
| β |
| **GitLab** | β
| β | β
| β |
| **Azure DevOps** | β
| β | β
| β |
| **Bitbucket Cloud** | β
| β | β | β
|
| **Bitbucket Server** | β | β | β
| β |
### Which Method Should You Use?
**Best for**: Most users and teams
**Pros**:
* Quick and easy setup
* No manual token management
* Automatic token refresh
* Revocable from VCS settings
**Cons**:
* Requires browser access
* May need org admin approval
**Best for**: GitHub organizations with fine-grained control needs
**Pros**:
* Granular repository access
* Organization-wide installation
* Better rate limits
* Enhanced security
**Cons**:
* GitHub only
* Requires org admin to install
**Best for**: Self-hosted instances, automation, CI/CD
**Pros**:
* Works with self-hosted VCS
* No OAuth redirect needed
* Full control over permissions
* Good for automation
**Cons**:
* Manual token creation
* No automatic refresh
* Must be kept secure
***
## What Permissions Does CodeThreat Need?
CodeThreat requests **read-only access** to your repositories:
### Repository Access
* β
**Read repository content**: To scan code for vulnerabilities
* β
**Read repository metadata**: To display repo names, branches, commits
* β
**Read pull requests**: To scan PR changes
* β **Write access**: CodeThreat never modifies your code
### Webhook Access
* β
**Create webhooks**: To receive notifications about commits and PRs
* β
**Read webhook events**: To trigger automatic scans
### Pull Request Integration (Optional)
* β
**Read PR changes**: To scan only modified code
* β
**Post PR comments**: To provide security feedback (if enabled)
* β
**Create checks**: To show pass/fail status (GitHub only)
CodeThreat operates on a **read-only** basis. We never push commits, modify files, or change repository settings.
***
## How Connections Work
When you connect a VCS platform:
You authorize CodeThreat to access your account via OAuth, token, or app installation
CodeThreat fetches a list of repositories you have access to
You choose which repositories to import for scanning
CodeThreat creates webhooks to receive notifications about code changes (if automated scanning is enabled)
CodeThreat automatically runs an initial security scan on imported repositories
***
## Next Steps
Connect GitHub repositories
Set up automatic scans
# Overview
Source: https://codethreat.mintlify.app/introduction
Autonomous AppSec platform combining deterministic security scanning with agentic analysis for contextual vulnerability detection and false positive elimination.
CodeThreat is an autonomous application security platform that combines deterministic security scanning engines with AI-powered agents for comprehensive code analysis and vulnerability detection.
## Platform Architecture
CodeThreat operates through two complementary layers:
**Deterministic Layer**: Rule-based security scanning engines perform pattern matching and static analysis across codebases.
**Agentic Layer**: AI agents provide contextual analysis, false positive elimination, and intelligent security reviews.
```mermaid theme={null}
graph LR
A[Your Code] --> B[Deterministic
Scanning]
B --> C[SAST + SCA + Secrets + IaC]
C --> D[SAST Results]
D --> E[False Positive
Elimination]
A --> F[Agentic SAST]
F --> G[Repository
Memory]
F --> H[Vuln Context]
A --> I[PR Review Agent
PR Analysis]
style B fill:#9449FE,stroke:#6627F9,color:#fff
style C fill:#9449FE,stroke:#6627F9,color:#fff
style E fill:#6627F9,stroke:#9449FE,color:#fff
style F fill:#6627F9,stroke:#9449FE,color:#fff
style G fill:#6627F9,stroke:#9449FE,color:#fff
style H fill:#6627F9,stroke:#9449FE,color:#fff
style I fill:#6627F9,stroke:#9449FE,color:#fff
```
***
## Pull Request Workflow
Every pull request triggers deterministic scanning and agentic analysis:
```mermaid theme={null}
flowchart LR
A[Developer
Creates PR] --> B[Deterministic
Scan]
B --> C[SAST Results]
C --> D[False Positive
Elimination]
A --> E[PR Review
Agent]
D --> F[Verified
Results]
E --> F
style B fill:#9449FE,stroke:#6627F9,color:#fff
style D fill:#6627F9,stroke:#9449FE,color:#fff
style E fill:#6627F9,stroke:#9449FE,color:#fff
```
1. **Developer creates PR** β CodeThreat automatically scans changed files
2. **Deterministic scanning** runs (SAST, SCA, Secrets, IaC)
3. **False Positive Elimination** filters SAST results
4. **PR Review Agent** analyzes PR changes with contextual understanding
5. **Security feedback** appears in PR comments
6. **Developer fixes** issues and pushes updates
***
## Full Repository Analysis
Agentic SAST performs comprehensive repository analysis:
```mermaid theme={null}
flowchart TB
A[Full Repository
Scan] --> B[Deterministic
Engines]
A --> C[Agentic SAST]
B --> D[SAST Results]
D --> E[False Positive
Elimination]
C --> F[Repository
Memory]
C --> G[Vuln Context]
E --> H[Complete
Report]
F --> H
G --> H
style B fill:#9449FE,stroke:#6627F9,color:#fff
style C fill:#6627F9,stroke:#9449FE,color:#fff
style E fill:#6627F9,stroke:#9449FE,color:#fff
style F fill:#6627F9,stroke:#9449FE,color:#fff
style G fill:#6627F9,stroke:#9449FE,color:#fff
```
1. **Full repository scan** β Runs deterministic engines and Agentic SAST
2. **Deterministic engines** run (SAST, SCA, Secrets, IaC)
3. **False Positive Elimination** filters deterministic SAST results
4. **Agentic SAST** performs deep analysis with **Repository Memory** and **Vuln Context** components
5. **Complete report** β All findings combined
***
## Deterministic Detection Engines
Deterministic scanning engines identify security vulnerabilities using established patterns, rules, and vulnerability databases. These work together with agentic analysis for complete security coverage.
Rule-based static analysis for code vulnerabilities. 1,740+ security rules across 27+ languages. Enhanced by False Positive Elimination agent and Agentic SAST deep analysis.
Dependency vulnerability scanning with CVE matching. Supports all major package managers.
Pattern-based detection of exposed credentials, API keys, and sensitive data.
Infrastructure-as-code scanning for configuration misconfigurations and compliance violations.
***
## Agentic Analysis Capabilities
AI agents operate autonomously to provide contextual security analysis beyond deterministic pattern matching.
Graph-based code analysis identifying logic flaws, authorization issues, and design failures.
Analyzes deterministic SAST results to reduce false positives through contextual understanding.
Contextual security analysis of pull requests with impact assessment and remediation guidance.
On-demand repository security analysis for design issues and architectural vulnerabilities.
***
## How It Works
CodeThreat integrates into your development workflow with three primary scanning modes:
### Pull Request Scanning
* Developer creates PR β **Deterministic SAST** scans changed files β **False Positive Elimination** filters results β **PR Review Agent** provides feedback β Developer fixes issues
### Push to Main Branch
* Code pushed to main β Full branch **deterministic scan** β **False Positive Elimination** β Results in dashboard
### Full Repository Analysis
* Full repository scan β All **deterministic engines** β **False Positive Elimination** β **Agentic SAST** with **Repository Memory** and **Vuln Context** components β Comprehensive report
See detailed workflows above for visual flow diagrams.
***
## Platform Capabilities
### Deterministic Security Scanning
* **Deterministic SAST**: Rule-based static analysis across 27+ languages, enhanced by **False Positive Elimination** and **Agentic SAST** for complex vulnerabilities
* **SCA**: Dependency vulnerability scanning across all major package ecosystems
* **Secrets Detection**: Pattern-based credential and API key detection
* **IaC Security**: Infrastructure configuration scanning for cloud platforms and IaC tools
### Agentic Security Analysis
* **Agentic SAST**: Deep code analysis using graph-based analysis for complex vulnerabilities
* **False Positive Elimination**: Contextual analysis of deterministic SAST results
* **PR Reviews**: Intelligent security review of pull requests
* **Security Analysis**: On-demand repository security analysis for design issues and architectural vulnerabilities
* **Repository Mapping**: Endpoint and database provider identification
***
## Next Steps
Connect repositories and run your first scan
Learn about rule-based static analysis
Understand AI-powered code analysis
Explore agentic security capabilities
Connect GitHub, GitLab, Azure DevOps, or Bitbucket
Learn about deterministic scanning engines
# Agentic SAST
Source: https://codethreat.mintlify.app/platform/agentic-sast
Full repository security analysis with AI agents that understand your application context
Agentic SAST analyzes your entire codebase to identify logic flaws, authorization issues, and design failures that traditional security tools miss.
## Agentic SAST vs Deterministic SAST
Agentic SAST is a separate agentic capability that runs independently from deterministic SAST. It's like PR Review Agent but for full repository analysis, with **Repository Memory** and **Vuln Context** components:
```mermaid theme={null}
graph TB
A[Your Code] --> B[Deterministic SAST
Rule Matching]
A --> C[Agentic SAST]
B --> D[Known Patterns
SQL Injection, XSS]
C --> E[Repository Memory]
C --> F[Vuln Context]
B --> G[SAST Results]
G --> H[False Positive
Elimination]
style B fill:#9449FE,stroke:#6627F9,color:#fff
style G fill:#9449FE,stroke:#6627F9,color:#fff
style C fill:#6627F9,stroke:#9449FE,color:#fff
style E fill:#6627F9,stroke:#9449FE,color:#fff
style F fill:#6627F9,stroke:#9449FE,color:#fff
style H fill:#6627F9,stroke:#9449FE,color:#fff
```
**Deterministic SAST**: Finds known vulnerability patterns quickly β **False Positive Elimination** filters results
***
## Agentic SAST Components
Agentic SAST consists of two key components:
### Repository Memory
Maintains a persistent understanding of your codebase structure, patterns, and relationships across scans. This enables the agent to:
* Remember architectural decisions and patterns
* Track how components interact over time
* Learn from previous analysis cycles
* Provide consistent analysis across scans
### Vuln Context
Analyzes vulnerability context by understanding:
* How vulnerabilities relate to your specific application architecture
* Historical context of similar issues in your codebase
* Business logic implications of security findings
* Cross-file relationships and dependencies
These components work together to provide deep, contextual security analysis that traditional tools cannot match.
***
Agent creates a complete map of your application structure, components, and relationships.
System builds dataflow and control flow graphs showing how data moves through your application and how code executes.
Agent reviews code file-by-file using the repository map and graphs to understand security issues in your specific application context.
Agent detects logic flaws, authorization issues, and design failures by understanding business logic and architectural patterns.
***
## CodeThreat-Hive Framework
CodeThreat-Hive is the AI framework that powers agentic analysis.
**Repository Mapping**: Creates a complete understanding of application structure before analyzing individual files.
**Graph-Based Analysis**: Builds dataflow and control flow graphs as the source of truth for understanding how your application executes.
**Contextual Memory**: Carries context throughout the analysis, enabling agents to understand how components interact and where security issues exist.
**Self-Reflective Agents**: AI agents evaluate their own reasoning to maintain analysis depth while optimizing efficiency.
***
## Language Support
CodeThreat uses tree-sitter to parse code and create grammars for target languages. This enables accurate syntax analysis across different programming languages.
Full list of supported languages will be available soon.
***
## Next Steps
Learn about AI-powered analysis
Understand autonomous investigation
Schedule and execute agentic SAST scans
# Infrastructure as Code Security
Source: https://codethreat.mintlify.app/platform/iac-security
Deterministic scanning of Terraform, Kubernetes, Docker, and cloud configurations
Infrastructure misconfigurations are a leading cause of cloud breaches. CodeThreat performs deterministic scanning of IaC files to identify security misconfigurations before deployment.
## What We Detect
Publicly exposed databases and storage buckets
CIS benchmarks and security best practices
Overly permissive IAM roles
Unencrypted data and open ports
***
## Supported Infrastructure
### Cloud Platforms
* **AWS**: CloudFormation, CDK, IAM policies, Security groups, S3 buckets
* **Azure**: ARM templates, Bicep, Network security groups, Storage accounts
* **GCP**: Deployment Manager, IAM policies, Firewall rules, Cloud Storage
### IaC Tools
* **Terraform**: HCL files and modules
* **Kubernetes**: YAML manifests and Helm charts
* **Docker**: Dockerfiles and compose files
* **Ansible**: Playbooks and roles
* **CloudFormation**: JSON and YAML templates
* **Pulumi**: TypeScript, Python, Go
[View complete IaC support matrix β](/reference/iac-support-matrix)
***
## Common Vulnerabilities
### Public Storage Buckets
```hcl theme={null}
# β Vulnerable
resource "aws_s3_bucket" "data" {
bucket = "company-data"
acl = "public-read"
}
# β
Secure
resource "aws_s3_bucket" "data" {
bucket = "company-data"
}
resource "aws_s3_bucket_public_access_block" "data" {
bucket = aws_s3_bucket.data.id
block_public_acls = true
block_public_policy = true
}
```
### Unrestricted Security Groups
```hcl theme={null}
# β Vulnerable - Open to world
resource "aws_security_group" "web" {
ingress {
from_port = 0
to_port = 65535
cidr_blocks = ["0.0.0.0/0"]
}
}
# β
Secure - Internal only
resource "aws_security_group" "web" {
ingress {
from_port = 443
to_port = 443
cidr_blocks = ["10.0.0.0/8"]
}
}
```
### Kubernetes Security
```yaml theme={null}
# β Vulnerable
securityContext:
privileged: true
runAsUser: 0
# β
Secure
securityContext:
runAsNonRoot: true
runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
```
***
## Compliance Frameworks
AWS, Azure, GCP, Kubernetes
Payment card industry standards
Healthcare data protection
Service organization controls
***
## Container Image Scanning
Scan Docker images for vulnerabilities in base images and dependencies.
```bash theme={null}
codethreat image scan myapp:latest
```
Scans detect:
* OS vulnerabilities in base images
* Application CVEs in dependencies
* Secrets in image layers
* Dockerfile best practices
***
## Configuration
Configure IaC scanning in repository settings:
* Enable/disable IaC scanning
* Select frameworks to scan
* Set severity thresholds
* Configure compliance frameworks
* Enable drift detection
***
## Best Practices
* Scan IaC files in CI/CD before deployment
* Use policy as code for compliance
* Monitor configuration drift
* Keep base images updated
* Automate remediation for common issues
***
## Next Steps
Configure IaC scanning
Add to your pipeline
# Deterministic SAST
Source: https://codethreat.mintlify.app/platform/sast
Rule-based static code analysis enhanced by agentic analysis
Deterministic SAST performs rule-based static analysis of your source code to identify security vulnerabilities using established patterns and security rules. Results are enhanced by **False Positive Elimination** agent and complemented by **Agentic SAST** for deep analysis of complex vulnerabilities.
## How It Works
Deterministic SAST uses pattern matching and rule-based detection:
1. **Pattern matching**: Identifies known vulnerable code patterns
2. **Dataflow analysis**: Tracks untrusted data through code
3. **Control flow analysis**: Identifies unsafe execution paths
4. **Semantic understanding**: Analyzes code structure and meaning
**Powered by**: OpenGrep (enhanced Semgrep fork) + ShiftQL intelligent analysis
**Coverage**: 1,740+ security rules across 27+ languages
***
## What Deterministic SAST Finds
* **Injection flaws**: SQL injection, command injection, code injection
* **Cross-Site Scripting (XSS)**: Reflected, stored, DOM-based
* **Authentication issues**: Broken auth, session management flaws
* **Authorization flaws**: Missing access controls, insecure direct object references
* **Cryptographic issues**: Weak algorithms, insecure random number generation
* **Security misconfigurations**: Debug mode enabled, default credentials
* **Input validation**: Missing or improper validation
* **Path traversal**: Directory traversal vulnerabilities
***
## Language Support
Deterministic SAST supports 27+ languages with comprehensive rule coverage.
**Deep coverage** (100+ rules each):
* Python (334 rules) - Django, Flask, FastAPI
* Terraform (362 rules) - AWS, Azure, GCP, Kubernetes
* JavaScript (173 rules) - React, Vue, Angular, Node.js
* Java (121 rules) - Spring, Jakarta EE
* YAML/Kubernetes (120 rules) - K8s manifests, Helm charts
* Ruby (92 rules) - Rails, Sinatra
* Go (76 rules) - Gin, Echo, standard library
* PHP (61 rules) - Laravel, Symfony, WordPress
* C# (51 rules) - ASP.NET, .NET Core
* Solidity (50 rules) - Smart contracts
**Additional support**: TypeScript, Scala, Kotlin, Swift, Rust, Elixir, OCaml, Bash, C/C++, Apex, Clojure, Dockerfile, HTML, JSON
[View complete SAST support matrix β](/reference/sast-support-matrix)
***
## False Positive Elimination
The False Positive Elimination agent analyzes deterministic SAST results to reduce false positives by understanding code context:
* Validates input sanitization before vulnerable sinks
* Recognizes framework-specific security protections
* Traces dataflow to verify exploitability
* Filters violations that aren't actually exploitable
[Learn more about False Positive Elimination β](/ai/false-positive-elimination)
***
## Agentic SAST
Agentic SAST performs deep code analysis using graph-based analysis to identify logic flaws, authorization issues, and design failures that deterministic SAST cannot detect.
[Learn more about Agentic SAST β](/platform/agentic-sast)
***
Configure deterministic SAST scanning in repository settings:
* Enable/disable SAST scanning
* Select rulesets to apply
* Configure scan paths and exclusions
* Set severity thresholds
* Enable false positive elimination
***
## Next Steps
View complete language coverage
Reduce false positives with AI
Deep AI-powered code analysis
Trigger security scans
# Software Composition Analysis
Source: https://codethreat.mintlify.app/platform/sca
Deterministic dependency vulnerability scanning
Software Composition Analysis (SCA) scans your dependencies and third-party libraries for known vulnerabilities using deterministic CVE matching against vulnerability databases.
## How SCA Works
SCA performs deterministic dependency scanning:
1. **Dependency Discovery**: Analyzes package manifests to build complete dependency tree
2. **Vulnerability Matching**: Queries vulnerability databases (NVD, GitHub Advisory, OSV) for known CVEs
3. **Version Analysis**: Identifies vulnerable versions and available fixes
4. **License Detection**: Analyzes license information for compliance
**Powered by**: Trivy (industry-standard vulnerability scanner)
***
## Coverage
SCA scans dependencies across all major programming ecosystems.
### Package Managers Supported
JavaScript/TypeScript
Python packages
Java dependencies
.NET packages
Go dependencies
Ruby gems
### Transitive Dependencies
SCA analyzes your entire dependency tree, including transitive dependencies.
[View complete SCA support matrix β](/reference/sca-support-matrix)
***
## What SCA Finds
* **CVE vulnerabilities**: Known security issues in dependencies with CVE identifiers
* **Outdated packages**: Dependencies with available security updates
* **Vulnerable transitive dependencies**: Issues in sub-dependencies
* **License violations**: Incompatible or risky licenses
***
## Vulnerability Intelligence
SCA queries multiple vulnerability databases:
* NVD (National Vulnerability Database)
* GitHub Security Advisories
* OSV (Open Source Vulnerabilities)
* Vendor security bulletins
* Language-specific advisory databases
Each finding includes CVSS scores and EPSS scores for prioritization.
***
## Best Practices
* Scan dependencies on every build
* Prioritize high EPSS vulnerabilities
* Update direct dependencies first
* Use lock files for reproducible builds
* Monitor EPSS score changes
***
## Next Steps
View complete package manager coverage
Workflow for fixing vulnerabilities
# Secret Detection
Source: https://codethreat.mintlify.app/platform/secret-detection
Deterministic detection of exposed credentials
Secret detection uses pattern-based scanning to identify exposed credentials, API keys, and sensitive data in your codebase, git history, and configuration files.
## What We Detect
AWS, Azure, GCP, GitHub, and 200+ services
Connection strings and passwords
SSH keys and TLS certificates
JWTs and OAuth tokens
***
## Detection Methods
### Pattern-Based Detection
Deterministic pattern matching using regex patterns for known secret formats and high-entropy string analysis.
```python theme={null}
# AWS Access Key detected
aws_access_key_id = "AKIAIOSFODNN7EXAMPLE"
aws_secret_access_key = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
# Severity: Critical
# Recommendation: Rotate immediately
```
### Contextual Analysis
Contextual analysis reduces false positives by examining code context. Placeholders like "your-api-key-here" are automatically excluded.
[View complete secrets support matrix β](/reference/secrets-support-matrix)
***
## Scan Coverage
### Source Code
Scans all code files across supported languages: Python, JavaScript, TypeScript, Java, Go, Ruby, PHP, C/C++, C#, Shell scripts, and more.
### Configuration Files
* Environment files (.env, .env.local)
* Config files (config.json, settings.yml)
* CI/CD configs (.github/workflows, .gitlab-ci.yml)
* Docker and Kubernetes configs
### Git History
Secrets remain in git history even after removal. CodeThreat scans full commit history to detect past exposures.
```bash theme={null}
codethreat secrets scan --include-history
```
***
## Secret Types
### Cloud Provider Credentials
* **AWS**: Access keys, session tokens, account IDs
* **Azure**: Connection strings, storage keys, service principals
* **GCP**: Service account JSON files, API keys
### Third-Party Services
* Development: GitHub, GitLab, NPM, Docker Hub tokens
* Payment: Stripe, PayPal credentials
* Communication: Slack, Twilio, SendGrid API keys
* Monitoring: Datadog, Sentry, PagerDuty tokens
***
## Remediation
### Immediate Actions
1. Revoke exposed credential via service provider
2. Generate new credential
3. Update all systems using the credential
4. Remove secret from git history if publicly exposed
### Secret Management
Integrate with secret management services:
* HashiCorp Vault
* AWS Secrets Manager
* Azure Key Vault
* GCP Secret Manager
***
## Configuration
Configure secret detection in repository settings:
* Enable/disable secret scanning
* Set entropy threshold
* Configure scan paths
* Exclude test files and mock data
***
## Best Practices
* Never commit secrets to version control
* Use environment variables or secret managers
* Scan regularly on all branches
* Rotate exposed credentials immediately
* Audit secret access regularly
***
## Next Steps
Configure secret detection
Block secrets in pipeline
# AI-Powered PR Reviews
Source: https://codethreat.mintlify.app/pull-requests/ai-reviews
Intelligent security analysis of pull requests
Get AI-generated security suggestions directly in your pull requests.
## AI PR Review Capabilities
[View complete AI PR reviews documentation β](/ai/pr-reviews)
* Security issue identification
* Contextual fix suggestions
* Priority and confidence ratings
* Code examples showing secure alternatives
## Enable AI PR Reviews
1. **Repository Settings** β **Pull Requests**
2. Toggle **AI PR Reviews** to enabled
3. Configure comment preferences
4. Save configuration
## What's Next?
Explore all AI capabilities
Fix identified issues
# Automated PR Scanning
Source: https://codethreat.mintlify.app/pull-requests/automated-scanning
Configure automatic security scanning for pull requests
Automatically scan every pull request for security vulnerabilities before merging.
## Enable Automated PR Scanning
[View complete setup guide β](/scanning/automated-scanning#pull-request-scanning)
Quick setup:
1. **Repository Settings** β **Automation**
2. Toggle **Auto-scan on PR** to enabled
3. Configure options (comments, AI reviews, thresholds)
4. Save configuration
## Configuration Options
**Post PR comments**: Add inline security feedback
**AI PR reviews**: Enable intelligent analysis
**Block merge on failure**: Require security approval
**Comment threshold**: Minimum severity to comment (Critical, High, Medium, Low)
## What's Next?
Understand PR workflow
Enable AI analysis
# GitHub Checks Integration
Source: https://codethreat.mintlify.app/pull-requests/github-checks
CodeThreat status checks on GitHub pull requests
CodeThreat appears as a required check on GitHub pull requests to gate insecure code.
## How GitHub Checks Work
CodeThreat posts a check status on every pull request:
* β
**Success**: No Critical/High severity violations
* β **Failed**: Security issues requiring attention
* β³ **Pending**: Scan in progress
## Require Checks Before Merge
Prevent merging vulnerable code with branch protection:
Repository β **Settings** β **Branches** β Select branch (e.g., `main`)
Enable **Require status checks to pass before merging**
Search for and select **CodeThreat Security Scan**
Click **Save changes**
Pull requests with failing security checks cannot be merged.
## Configure Pass/Fail Criteria
**Repository Settings** β **Pull Requests** β **Pass Criteria**
Choose what causes checks to fail:
* Fail on Critical violations
* Fail on High violations
* Fail on Medium violations
* Fail on Low violations
Start by failing only on Critical violations, then progressively tighten criteria as your security posture improves.
## What's Next?
Configure PR security scanning
Set up automation
# Pull Request Integration
Source: https://codethreat.mintlify.app/pull-requests/overview
Security scanning and feedback in your pull requests
CodeThreat integrates directly into your pull request workflow to provide security feedback before code is merged. Every PR triggers **deterministic scanning** (SAST, SCA, Secrets, IaC), **False Positive Elimination**, and **PR Review Agent** for complete security coverage.
## Pull Request Workflow
```mermaid theme={null}
sequenceDiagram
participant Dev as Developer
participant PR as Pull Request
participant CT as CodeThreat
participant DS as Deterministic Scan
participant FP as FP Elimination
participant PRR as PR Review Agent
Dev->>PR: Create/Update PR
PR->>CT: Webhook triggered
CT->>DS: Scan changed files
(SAST, SCA, Secrets, IaC)
DS->>FP: SAST Results
FP->>FP: Filter false positives
CT->>PRR: Analyze PR changes
FP->>PR: Post filtered violations
PRR->>PR: Post security feedback
PR->>Dev: Show results & comments
```
## Why PR Security Scanning?
Catch vulnerabilities during code review, not after deployment
Get security insights in minutes, not days
Prevent insecure code from reaching main branches
Security feedback in your existing workflow
## How It Works
Developer creates or updates a pull request
CodeThreat automatically scans changed files with deterministic engines (SAST, SCA, Secrets, IaC)
False Positive Elimination filters SAST results, PR Review Agent analyzes changes for security issues
* GitHub Check shows pass/fail
* Summary comment with findings
* Inline comments on vulnerable code
Developer addresses security feedback
Updated PR is automatically re-scanned
Once checks pass, PR can be merged
## Enable PR Integration
[View PR Scanning setup β](/scanning/pr-scanning)
[Enable AI PR Reviews β](/ai/pr-reviews)
## What's Next?
Set up PR security scanning
Enable intelligent AI analysis
Configure automated triggers
Understand PR status checks
# Quick Start Guide
Source: https://codethreat.mintlify.app/quickstart
Get your first repository scanned in under 5 minutes
This guide walks you through connecting your first repository and running your first security scan. You'll be up and running in under 5 minutes.
## What You'll Need
* A CodeThreat account ([sign up here](https://app.codethreat.com/signup))
* Access to repositories you want to scan (GitHub, GitLab, Azure DevOps, or Bitbucket)
* Admin permissions for those repositories
***
## Step 1: Sign Up and Create Your Organization
Visit [app.codethreat.com/signup](https://app.codethreat.com/signup) and sign up with your email or GitHub account.
Signing up with GitHub allows faster repository connection.
Follow the onboarding flow to set up your organization profile and preferences.
Your personal organization is created automatically.
***
## Step 2: Connect Your Version Control System
Choose your VCS provider and follow the connection steps:
1. Navigate to **Settings** β **Integrations**
2. Click **Connect GitHub**
3. Authorize CodeThreat to access your repositories
4. Select repositories to import
GitHub connection complete! Your repositories will appear in the dashboard.
[View detailed GitHub setup β](/integrations/github)
1. Navigate to **Settings** β **Integrations**
2. Click **Connect GitLab**
3. Authorize CodeThreat
4. Select projects to import
[View detailed GitLab setup β](/integrations/gitlab)
1. Navigate to **Settings** β **Integrations**
2. Click **Connect Azure DevOps**
3. Enter your organization name
4. Provide a Personal Access Token
5. Select repositories to import
[View detailed Azure DevOps setup β](/integrations/azure-devops)
1. Navigate to **Settings** β **Integrations**
2. Click **Connect Bitbucket**
3. Choose Bitbucket Cloud or Server
4. Authorize and select repositories
[View detailed Bitbucket setup β](/integrations/bitbucket-cloud)
***
## Step 3: Run Your First Scan
From your dashboard, click on a repository you just imported
Click the **Scan Now** button in the repository view.
CodeThreat will:
* Clone your repository
* Run SAST, SCA, Secrets Detection, and IaC Security scans
* Process results and calculate security scores
Initial scans typically complete within 2-5 minutes, depending on repository size.
Once the scan completes, you'll see:
* Total violations by severity (Critical, High, Medium, Low, Info)
* Violation types breakdown (SAST, SCA, SECRET, IAC)
* Security score and trends
* Top vulnerabilities requiring attention
***
## Step 4: Review Your First Violation
Click **Violations** in the repository navigation to see all security findings
Click any violation to view:
* Code snippet showing the vulnerable code
* Location (file and line number)
* Severity with CVSS and EPSS scores
* Description explaining the security risk
* Remediation steps to fix the issue
You can:
* Fix the violation in your code
* Suppress it if it's a false positive
* Assign it to a team member
* Comment for discussion
***
## What's Next?
You've successfully connected your first repository and run a security scan. Here's what to do next:
Scan every commit and pull request automatically
Collaborate with team members on security
Let AI eliminate false positives and review PRs
# IaC Security Support
Source: https://codethreat.mintlify.app/reference/iac-support-matrix
Infrastructure as Code security scanning coverage
CodeThreat uses **Trivy** for Infrastructure as Code security scanning, detecting misconfigurations before deployment.
## Supported IaC Formats
### Terraform
**File Types**: `.tf` (HCL), `.tf.json`
**Providers Supported**:
* **AWS**: 200+ checks covering EC2, S3, RDS, IAM, VPC, Lambda, and more
* **Azure**: 150+ checks for Virtual Machines, Storage, Databases, Key Vault, etc.
* **Google Cloud**: 100+ checks for Compute, Storage, IAM, Networking
* **Kubernetes**: 80+ checks for pod security, RBAC, network policies
**Common Checks**:
* Public S3 buckets / Azure Storage
* Unencrypted storage volumes
* Overly permissive IAM policies / Security Groups
* Missing encryption at rest
* Insecure network configurations
* Publicly exposed databases
* Missing backup configurations
### Kubernetes
**File Types**: `.yaml`, `.yml` manifests, Helm charts
**Resource Types Scanned**:
* Pods, Deployments, StatefulSets, DaemonSets
* Services (LoadBalancer, NodePort exposure risks)
* ConfigMaps, Secrets (insecure usage)
* RBAC (Roles, ClusterRoles, RoleBindings)
* NetworkPolicies
* PodSecurityPolicies
* Ingress configurations
**Common Checks**:
* Containers running as root
* Privileged containers
* Host network/IPC/PID access
* Missing resource limits (CPU, memory)
* Insecure volume mounts
* Exposed secrets in environment variables
* Missing security contexts
* Overly permissive RBAC
### Docker
**File Types**: `Dockerfile`, `docker-compose.yml`
**Dockerfile Checks**:
* Vulnerable base images
* Running as root user
* Exposed sensitive ports (22, 3306, 5432, etc.)
* Hardcoded secrets
* Missing health checks
* Using `latest` tag (unpinned versions)
* Installing unnecessary packages
* Not using multi-stage builds
**docker-compose Checks**:
* Exposed ports
* Insecure volume mounts
* Missing resource limits
* Privileged mode usage
### CloudFormation
**File Types**: `.yaml`, `.yml`, `.json` (AWS templates)
**AWS Resource Checks**:
* IAM policies and roles
* Security groups
* S3 bucket policies
* RDS encryption
* Lambda security
* API Gateway configuration
* CloudTrail logging
### ARM Templates
**File Types**: `.json` (Azure Resource Manager)
**Azure Resource Checks**:
* Storage account encryption
* VM security
* Network security groups
* Key Vault policies
* SQL Database encryption
### Other Formats
**Helm Charts**: Scans rendered YAML
**Kustomize**: Scans generated manifests
**Ansible**: Playbook security checks
**Pulumi/CDK**: Scans generated templates
## Misconfiguration Categories
### Public Exposure
β **S3 buckets** publicly accessible\
β **Azure Blob Storage** public access\
β **Databases** exposed to internet (0.0.0.0/0)\
β **Load balancers** with open security groups\
β **Storage accounts** without network restrictions
### Missing Encryption
β **S3** without server-side encryption\
β **EBS volumes** unencrypted\
β **RDS databases** without encryption at rest\
β **Azure Storage** without encryption\
β **GCP Disks** unencrypted
### Overly Permissive IAM
β **IAM policies** with wildcard (`*`) actions\
β **Service accounts** with admin permissions\
β **Security groups** allowing 0.0.0.0/0\
β **RBAC** cluster-admin to all users\
β **Resource policies** too permissive
### Container Security
β **Running as root** in containers\
β **Privileged containers** without justification\
β **Host network** access\
β **Missing resource limits**\
β **Insecure capabilities** (SYS\_ADMIN, NET\_ADMIN)
### Configuration Issues
β **Debug mode** enabled in production\
β **Default passwords** or credentials\
β **Logging disabled** for audit trails\
β **Monitoring** not configured\
β **Backup** policies missing
## Cloud Provider Coverage
### AWS (200+ Checks)
**Compute**: EC2, Lambda, ECS, EKS, Batch\
**Storage**: S3, EBS, EFS\
**Database**: RDS, DynamoDB, ElastiCache, DocumentDB\
**Networking**: VPC, Security Groups, NACLs, ELB/ALB\
**IAM**: Policies, Roles, Users, Groups\
**Security**: KMS, Secrets Manager, GuardDuty\
**Monitoring**: CloudTrail, CloudWatch
### Azure (150+ Checks)
**Compute**: Virtual Machines, Container Instances, AKS\
**Storage**: Blob Storage, Managed Disks\
**Database**: SQL Database, CosmosDB, PostgreSQL\
**Networking**: Virtual Networks, NSGs, Application Gateway\
**Identity**: Active Directory, Managed Identities\
**Security**: Key Vault, Security Center
### Google Cloud (100+ Checks)
**Compute**: Compute Engine, GKE, Cloud Run, Cloud Functions\
**Storage**: Cloud Storage, Persistent Disks\
**Database**: Cloud SQL, Firestore, Bigtable\
**Networking**: VPC, Firewalls, Load Balancers\
**IAM**: Service Accounts, IAM Policies\
**Security**: KMS, Secret Manager
## Kubernetes-Specific Security
**Pod Security**:
* RunAsNonRoot enforcement
* ReadOnlyRootFilesystem
* AllowPrivilegeEscalation=false
* Seccomp profiles
* AppArmor profiles
**Network Security**:
* NetworkPolicy enforcement
* Service mesh configuration
* Ingress TLS
* Internal-only services
**RBAC Security**:
* Least privilege principles
* No cluster-admin bindings
* Service account token mounting
* API access restrictions
**Secret Management**:
* External secret stores (Vault, etc.)
* Encrypted secrets
* Secret rotation
* No secrets in environment variables
## Best Practices Detection
Trivy also identifies best practice violations:
β
**Missing labels** for resource organization\
β
**Untagged resources** (cost tracking issues)\
β
**No lifecycle policies** for storage\
β
**Missing monitoring/alerting** configuration\
β
**Inadequate backup** strategies
## What Makes IaC Scanning Different
**Shift-left approach**: Catch misconfigurations in code, not after deployment
**Multi-cloud**: One scanner for AWS, Azure, GCP, Kubernetes
**Comprehensive**: Security + compliance + best practices
**Integrated**: Part of the same workflow as SAST and SCA
## Compliance Frameworks
Trivy's IaC checks align with:
**CIS Benchmarks**:
* CIS AWS Foundations Benchmark
* CIS Azure Foundations Benchmark
* CIS GCP Foundations Benchmark
* CIS Kubernetes Benchmark
**Security Standards**:
* NIST Cybersecurity Framework
* ISO 27001 controls
* SOC 2 requirements
* PCI-DSS infrastructure requirements
IaC scanning is only available on the PRO plan. FREE plan includes SAST and SCA only.
## What's Next?
Secret type coverage
Start scanning infrastructure
# SAST Support Matrix
Source: https://codethreat.mintlify.app/reference/sast-support-matrix
Complete language and framework coverage for static code analysis
CodeThreat uses **OpenGrep** (our enhanced fork of Semgrep) combined with **ShiftQL's intelligent analysis** to provide comprehensive static application security testing across 27+ languages with **1,740+ security rules**.
## Supported Languages
### Primary Languages (Deep Coverage)
| Language | Rules | Frameworks Supported | Coverage |
| -------------- | ----- | ------------------------------------- | ------------------------ |
| **Python** | 334 | Django, Flask, FastAPI, Pyramid | OWASP Top 10, CWE Top 25 |
| **Terraform** | 362 | AWS, Azure, GCP, Kubernetes | Infrastructure security |
| **JavaScript** | 173 | React, Vue, Angular, Express, Node.js | Frontend & backend |
| **Java** | 121 | Spring, Jakarta EE, Struts, Play | Enterprise applications |
| **TypeScript** | 30 | React, Angular, Next.js, NestJS | Modern web apps |
| **Go** | 76 | Gin, Echo, Fiber, standard library | Cloud-native apps |
| **Ruby** | 92 | Rails, Sinatra, Grape | Web applications |
| **PHP** | 61 | Laravel, Symfony, WordPress, Drupal | CMS and web apps |
| **C#** | 51 | ASP.NET, .NET Core, Entity Framework | Windows & cross-platform |
### Additional Languages
| Language | Rules | Use Cases |
| ------------------- | ----- | ------------------------------------------ |
| **YAML/Kubernetes** | 120 | K8s manifests, Helm charts, docker-compose |
| **Scala** | 27 | Play Framework, Akka, Spark |
| **Solidity** | 50 | Smart contracts, DeFi, blockchain |
| **Kotlin** | 14 | Android, Spring Boot, server-side |
| **Rust** | 10 | Systems programming, web services |
| **Swift** | 4 | iOS, macOS applications |
| **Elixir** | 7 | Phoenix Framework |
| **OCaml** | 23 | Functional programming |
| **Bash/Shell** | 6 | Scripts, DevOps automation |
| **C/C++** | 16 | Systems programming |
| **Apex** | 18 | Salesforce development |
| **Clojure** | 5 | JVM functional programming |
| **Dockerfile** | 35 | Container security |
| **HTML** | 6 | Template security |
| **JSON** | 4 | Configuration security |
### Generic Rules
**37 problem-based rules** that work across all languages:
* Hardcoded secrets
* Insecure random number generation
* Weak cryptography
* Insecure deserialization
* And more
**25 AI-specific rules** for emerging AI/ML security concerns
## Framework-Specific Detection
### Web Frameworks
**Python**:
* Django ORM injection detection
* Flask template injection
* FastAPI security misconfigurations
* Pyramid authorization flaws
**JavaScript/TypeScript**:
* React XSS and dangerouslySetInnerHTML
* Vue.js template injection
* Express.js route security
* Next.js API route vulnerabilities
**Java**:
* Spring Security misconfigurations
* Hibernate/JPA injection
* Jakarta EE authentication flaws
* Struts OGNL injection
**Ruby**:
* Rails mass assignment
* ActiveRecord SQL injection
* Sinatra route security
* Rails CSRF bypass
**PHP**:
* Laravel query injection
* Symfony security component misuse
* WordPress plugin vulnerabilities
* Drupal access control
**Go**:
* Gin parameter injection
* Echo template rendering
* Standard library SQL issues
* Goroutine race conditions
### Mobile Frameworks
**iOS (Swift)**:
* KeyChain misuse
* Insecure data storage
* SSL pinning issues
**Android (Kotlin/Java)**:
* Intent injection
* WebView security
* SharedPreferences exposure
## Vulnerability Categories
### OWASP Top 10 (2021) Coverage
| OWASP 2021 Category | Detection | Rule Count | Examples |
| ---------------------------------- | ----------- | ---------- | ------------------------------------------------------------------------ |
| **A01: Broken Access Control** | β
Full | 100+ | Missing authorization, IDOR, path traversal, privilege escalation |
| **A02: Cryptographic Failures** | β
Full | 80+ | MD5/SHA1 usage, weak crypto, hardcoded secrets, insecure random |
| **A03: Injection** | β
Full | 400+ | SQL, NoSQL, Command, LDAP, XPath, XML, OS command injection |
| **A04: Insecure Design** | β
Partial | 50+ | Missing rate limiting, trust boundary violations, security anti-patterns |
| **A05: Security Misconfiguration** | β
Full | 150+ | Debug enabled, defaults, CORS, headers, verbose errors |
| **A06: Vulnerable Components** | β οΈ SCA Tool | - | Use Trivy SCA for dependency vulnerabilities |
| **A07: Auth/Session Failures** | β
Full | 90+ | Broken auth, session fixation, weak passwords, missing MFA |
| **A08: Data Integrity Failures** | β
Full | 70+ | Insecure deserialization (Pickle, YAML, JSON), unsigned JWTs |
| **A09: Logging Failures** | β
Partial | 30+ | Credentials in logs, insufficient logging, sensitive data exposure |
| **A10: SSRF** | β
Full | 40+ | Server-side request forgery, unsafe URL construction |
**Compliance**: Rules tagged with OWASP 2017 and OWASP 2021 categories
### CWE Top 25 Coverage
CodeThreat detects **CWE Top 25 (2021 & 2022)** most dangerous software weaknesses:
β
**Complete coverage** of CWE Top 25 including:
**Injection (CWE-74)**:
* CWE-89: SQL Injection
* CWE-78: OS Command Injection
* CWE-79: Cross-Site Scripting
* CWE-91: XML Injection
* CWE-943: NoSQL Injection
**Cryptography (CWE-310)**:
* CWE-327: Broken/Risky Crypto
* CWE-328: Weak Hash
* CWE-330: Weak Random
* CWE-331: Insufficient Entropy
* CWE-326: Inadequate Encryption
**Authentication (CWE-287)**:
* CWE-287: Improper Authentication
* CWE-306: Missing Authentication
* CWE-307: Improper Restriction of Excessive Authentication Attempts
* CWE-798: Use of Hard-coded Credentials
**Authorization (CWE-285)**:
* CWE-285: Improper Authorization
* CWE-862: Missing Authorization
* CWE-863: Incorrect Authorization
**Additional CWE Coverage**:
* CWE-79: Cross-Site Scripting
* CWE-22: Path Traversal
* CWE-416: Use After Free
* CWE-434: Unrestricted Upload
* CWE-352: CSRF
* CWE-601: Open Redirect
* And 100+ more CWE categories
**Compliance Tags**: Rules are tagged with CWE-2021-Top-25 and CWE-2022-Top-25 for prioritization
## Language-Specific Vulnerabilities
### Python-Specific
β
Django template injection\
β
Pickle deserialization\
β
Eval/exec code execution\
β
YAML unsafe load\
β
Flask Jinja2 SSTI\
β
SQLAlchemy injection\
β
subprocess shell injection
### JavaScript/TypeScript-Specific
β
Prototype pollution\
β
RegExp DoS\
β
`eval()` and `Function()` usage\
β
`innerHTML` XSS\
β
Express route parameter injection\
β
JWT algorithm confusion\
β
Path traversal
### Java-Specific
β
Deserialization of untrusted data\
β
JNDI injection (Log4Shell-style)\
β
Spring SpEL injection\
β
XML External Entity (XXE)\
β
JDBC SQL injection\
β
Reflection abuse
### Go-Specific
β
SQL injection in database/sql\
β
Command injection in exec.Command\
β
Path traversal\
β
Unsafe reflection\
β
Race conditions
### Infrastructure as Code
**Terraform** (362 rules):
β
Public S3 buckets\
β
Unencrypted storage\
β
Overly permissive IAM\
β
Missing security groups\
β
Insecure network configs
**Kubernetes/YAML** (120 rules):
β
Privileged containers\
β
Host network access\
β
Missing resource limits\
β
Insecure volume mounts\
β
Exposed secrets
**Dockerfile** (35 rules):
β
Running as root\
β
Vulnerable base images\
β
Exposed secrets\
β
Missing health checks
### Blockchain/Smart Contracts
**Solidity** (50 rules):
β
Reentrancy vulnerabilities\
β
Integer overflow/underflow\
β
Unchecked external calls\
β
Access control issues\
β
Gas optimization
## Compliance and Standards
**OWASP Top 10 (2021)**: Full coverage of all 10 categories with 1,000+ relevant rules
**CWE Top 25**: Complete coverage of most dangerous weaknesses (2021 & 2022 lists)
**SANS Top 25**: Aligned with SANS/CWE Most Dangerous Software Errors
Rules are tagged with compliance standards for easy filtering and reporting.
While CodeThreat doesn't have specific PCI-DSS or HIPAA rule sets, our OWASP Top 10 and CWE coverage addresses the security requirements mandated by these compliance frameworks.
## What Makes Our SAST Different
**1,740+ Rules**: More coverage than most commercial tools
**OpenGrep + ShiftQL**: We enhanced Semgrep with our own intelligence layer
**Framework-Aware**: Understands Django ORM, React escaping, Spring Security, Rails protections
**Low False Positives**: Rules tuned for precision, then AI filters context-aware
**Continuous Updates**: New rules added weekly for emerging vulnerability patterns
Enable SAST scanning to catch code-level vulnerabilities before they reach production. Most findings can be fixed in minutes once identified.
## What's Next?
Dependency scanning coverage
Start scanning for vulnerabilities
Understanding SAST, SCA, Secrets, IaC
# SCA Support Matrix
Source: https://codethreat.mintlify.app/reference/sca-support-matrix
Complete package ecosystem and dependency scanning coverage
CodeThreat uses **Trivy** and **Syft** for Software Composition Analysis, scanning dependencies across all major programming ecosystems for known vulnerabilities.
## Package Ecosystems Supported
### JavaScript/TypeScript
| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| --------------- | -------------- | ------------------- | --------------- |
| **npm** | `package.json` | `package-lock.json` | β
|
| **Yarn** | `package.json` | `yarn.lock` | β
|
| **Yarn v2+** | `package.json` | `yarn.lock` | β
|
| **pnpm** | `package.json` | `pnpm-lock.yaml` | β
|
**Scans for**:
* Known CVEs in npm packages
* Vulnerable transitive dependencies
* Outdated packages with security updates
* License compliance (MIT, Apache, GPL, etc.)
### Python
| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| --------------- | ------------------------------------------- | -------------- | --------------- |
| **pip** | `requirements.txt`, `setup.py`, `setup.cfg` | - | β
|
| **Pipenv** | `Pipfile` | `Pipfile.lock` | β
|
| **Poetry** | `pyproject.toml` | `poetry.lock` | β
|
| **Conda** | `environment.yml`, `environment.yaml` | - | β
|
| **PDM** | `pyproject.toml` | `pdm.lock` | β
|
**Scans for**:
* PyPI package vulnerabilities
* Dependency confusion attacks
* Outdated packages (Django, Flask, etc.)
* License issues
### Java/Kotlin/Scala
| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| --------------- | ---------------------------------- | ----------------- | --------------- |
| **Maven** | `pom.xml` | - | β
|
| **Gradle** | `build.gradle`, `build.gradle.kts` | `gradle.lockfile` | β
|
| **sbt** | `build.sbt` | - | β
|
**Scans for**:
* JAR file vulnerabilities
* Critical issues (Log4Shell, Spring4Shell)
* Transitive dependency CVEs
* Maven Central vulnerabilities
### .NET/C\#
| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| --------------- | ----------------------------------------------------- | --------------------- | --------------- |
| **NuGet** | `*.csproj`, `packages.config`, `*.fsproj`, `*.vbproj` | `packages.lock.json` | β
|
| **.NET CLI** | `*.csproj` | `project.assets.json` | β
|
**Scans for**:
* NuGet package vulnerabilities
* .NET Framework/Core vulnerabilities
* Dependency version conflicts
### Go
| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| --------------- | -------------- | --------- | --------------- |
| **Go Modules** | `go.mod` | `go.sum` | β
|
**Scans for**:
* Go module CVEs
* Standard library vulnerabilities
* Indirect dependency issues
### Ruby
| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| --------------- | -------------- | -------------- | --------------- |
| **Bundler** | `Gemfile` | `Gemfile.lock` | β
|
**Scans for**:
* RubyGems vulnerabilities
* Rails framework CVEs
* Gem dependency issues
### PHP
| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| --------------- | --------------- | --------------- | --------------- |
| **Composer** | `composer.json` | `composer.lock` | β
|
**Scans for**:
* Packagist vulnerabilities
* WordPress/Drupal plugin CVEs
* Laravel/Symfony framework issues
### Rust
| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| --------------- | -------------- | ------------ | --------------- |
| **Cargo** | `Cargo.toml` | `Cargo.lock` | β
|
**Scans for**:
* Crates.io vulnerabilities
* RustSec advisories
* Dependency audit findings
### iOS/macOS
| Package Manager | Manifest Files | Lockfiles | Transitive Deps |
| ------------------------- | --------------- | ------------------- | --------------- |
| **CocoaPods** | `Podfile` | `Podfile.lock` | β
|
| **Swift Package Manager** | `Package.swift` | `Package.resolved` | β
|
| **Carthage** | `Cartfile` | `Cartfile.resolved` | β
|
**Scans for**:
* Pod vulnerabilities
* Swift package CVEs
* Framework security issues
### Additional Ecosystems
| Ecosystem | Package Manager | Manifest Files | Support |
| ---------------- | --------------- | ------------------------------- | ------- |
| **Dart/Flutter** | pub | `pubspec.yaml`, `pubspec.lock` | β
|
| **Elixir** | Mix | `mix.exs`, `mix.lock` | β
|
| **Haskell** | Cabal | `*.cabal` | β
|
| **C/C++** | Conan | `conanfile.txt`, `conanfile.py` | β
|
| **Erlang** | Rebar3 | `rebar.config` | β
|
## Operating System Packages
Trivy scans OS-level packages in container images and VMs:
### Linux Distributions
| Distribution | Versions | Package Format | CVE Database |
| ---------------- | ---------------- | -------------- | ----------------------- |
| **Alpine Linux** | 3.2+ | apk | Alpine SecDB |
| **Debian** | 7-12 | apt/dpkg | Debian Security Tracker |
| **Ubuntu** | 14.04+ | apt/dpkg | Ubuntu Security Notices |
| **RHEL/CentOS** | 6-9 | yum/rpm | Red Hat Security Data |
| **Amazon Linux** | 1, 2, 2023 | yum/rpm | Amazon Linux Security |
| **Oracle Linux** | 5-9 | yum/rpm | Oracle Security |
| **Rocky Linux** | 8-9 | dnf/rpm | Rocky Security |
| **AlmaLinux** | 8-9 | dnf/rpm | AlmaLinux Security |
| **Fedora** | 30+ | dnf/rpm | Fedora Security |
| **Photon OS** | 1.0-4.0 | tdnf/rpm | VMware Photon Security |
| **OpenSUSE** | Leap, Tumbleweed | zypper/rpm | SUSE Security |
| **SLES** | 11-15 | zypper/rpm | SUSE Security |
| **Arch Linux** | Current | pacman | Arch Security |
| **Wolfi OS** | Current | apk | Wolfi SecDB |
| **Chainguard** | Current | apk | Chainguard Security |
## Container Base Image Scanning
**Detects vulnerabilities in**:
* `FROM alpine:3.18`
* `FROM ubuntu:22.04`
* `FROM node:18`
* `FROM python:3.11`
* `FROM nginx:latest`
* Any Docker base image
**Also scans**:
* Distroless images
* Scratch-based images (if packages are installed)
* Multi-stage build layers
## SBOM (Software Bill of Materials)
**Generated by Syft, analyzed by Trivy**:
**SBOM Formats Supported**:
* **CycloneDX** (JSON, XML) - Industry standard
* **SPDX** (JSON, YAML) - Linux Foundation standard
* **Syft JSON** - Detailed format
* **GitHub Dependency** - For GitHub integration
**What's Included in SBOM**:
* All direct dependencies
* All transitive dependencies
* Package versions
* Licenses
* Package URLs (PURL)
* File locations
**Use Cases**:
* Supply chain security compliance
* Vendor questionnaires
* Regulatory requirements (SBOM mandates)
* Vulnerability tracking over time
## Vulnerability Databases Queried
Trivy queries **multiple sources** for comprehensive CVE coverage:
**Language-Specific**:
* npm (Node Security Working Group)
* PyPI (Python Advisory Database)
* RubyGems (Ruby Advisory Database)
* Maven Central (Sonatype OSS Index)
* Go Vulnerability Database
* Rust Security Advisory Database
* PHP Security Advisories
**General**:
* National Vulnerability Database (NVD)
* GitHub Security Advisories (GHSA)
* GitLab Advisory Database
* OSV (Open Source Vulnerabilities)
**OS-Specific**:
* Debian Security Tracker
* Ubuntu Security Notices
* Red Hat Security Data
* Alpine SecDB
* Amazon Linux Security Center
**Update Frequency**: Daily updates ensure you catch CVEs within 24 hours of disclosure
## False Positive Handling
**Trivy is highly accurate** for SCA because it matches exact package versions against known CVEs. False positives are rare.
**When they occur**:
* CVE doesn't affect the specific code path you use
* Vulnerability is in optional feature you don't enable
* Mitigation exists at infrastructure level
**CodeThreat AI** can analyze SCA findings for:
* Actual exploitability in your code
* Whether vulnerable code path is reachable
* Mitigation controls present
## What's Next?
Code scanning language coverage
Infrastructure scanning coverage
# Secrets Detection Support
Source: https://codethreat.mintlify.app/reference/secrets-support-matrix
Complete coverage of secret types and credential patterns detected
CodeThreat uses **Gitleaks v8.24+** for comprehensive secrets detection across your codebase and Git history.
## Detection Methods
**Pattern Matching**: Regex patterns for 200+ known credential formats
**Entropy Analysis**: Detects high-entropy strings likely to be secrets
**Git History Scanning**: Checks all commits, not just current code
**Context Awareness**: Reduces false positives by examining surrounding code
## Supported Secret Types
### Cloud Provider Credentials
**AWS**:
* AWS Access Key ID
* AWS Secret Access Key
* AWS Session Token
* AWS Account ID patterns
* AWS MWS Auth Token
**Azure**:
* Azure Storage Account Keys
* Azure Service Principal credentials
* Azure Subscription Keys
* Azure CosmosDB Keys
* Azure DevOps Personal Access Tokens
**Google Cloud (GCP)**:
* GCP API Keys
* GCP Service Account Keys (JSON)
* Google OAuth credentials
* Firebase credentials
* Google Cloud Storage keys
**DigitalOcean**:
* DigitalOcean Access Tokens
* DigitalOcean Personal Access Tokens
* DigitalOcean OAuth tokens
**Heroku**:
* Heroku API Keys
* Heroku OAuth tokens
**Alibaba Cloud**:
* Alibaba Access Keys
* Alibaba Secret Keys
### SaaS/API Keys
**Payment Processing**:
* Stripe API Keys (Live & Test)
* Stripe Publishable Keys
* Stripe Restricted Keys
* PayPal Client ID/Secret
* Square Access Tokens
**Communication**:
* Twilio API Keys and Auth Tokens
* SendGrid API Keys
* Mailgun API Keys
* Mailchimp API Keys
* Slack Tokens and Webhooks
* Discord Tokens
**Development Tools**:
* GitHub Tokens (Personal Access, OAuth)
* GitLab Tokens
* Bitbucket App Passwords
* Azure DevOps PATs
* CircleCI Tokens
* Travis CI Tokens
* Jenkins API Tokens
**Infrastructure**:
* HashiCorp Vault tokens
* Datadog API Keys
* New Relic API Keys
* Sentry Auth Tokens
**Databases**:
* MongoDB Connection Strings
* PostgreSQL Connection Strings
* MySQL Connection Strings
* Redis Passwords
* Cassandra Passwords
* Elasticsearch credentials
### Private Keys & Certificates
**SSH Keys**:
* RSA Private Keys
* DSA Private Keys
* EC Private Keys
* ed25519 Private Keys
* OpenSSH Private Keys
**SSL/TLS**:
* Private Key files (.key, .pem)
* Certificate files
* PKCS#12 (.p12, .pfx)
* Java KeyStore (.jks)
**Code Signing**:
* GPG Private Keys
* PGP Private Keys
* Apple Code Signing keys
### Authentication Tokens
**OAuth & JWT**:
* OAuth Client Secrets
* OAuth Refresh Tokens
* JWT Secrets
* Bearer Tokens
* Session Tokens
**Generic Patterns**:
* Generic API Keys
* Generic Secrets
* Generic Passwords
* Basic Auth credentials
## What Gitleaks Scans
### Current Codebase
* All files in repository
* Configuration files (.env, config.yaml, etc.)
* Infrastructure as Code files
* Documentation and README files
* Embedded credentials in code
### Git History
* All commits across all branches
* Deleted files still in history
* Renamed files
* File content before .gitignore was added
* Merge commits
**Why this matters**: Even if you remove a secret, it remains in Git history and should be considered compromised.
## File Types Scanned
**Configuration Files**:
* `.env`, `.env.local`, `.env.production`
* `config.yaml`, `config.json`, `settings.py`
* `.aws/credentials`, `.azure/credentials`
* `.npmrc`, `.pypirc`
**Infrastructure Files**:
* Terraform (`.tf`)
* Kubernetes manifests (`.yaml`)
* Docker Compose files
* CI/CD configs (`.gitlab-ci.yml`, `.github/workflows/`)
**Code Files**:
* All programming languages
* Scripts (bash, python, etc.)
* Database migration files
**Documentation**:
* README.md, documentation files
* Comments in code
* Jupyter notebooks
## What Gitleaks Doesn't Detect
β **Encrypted secrets** (they look like random strings)\
β **Secrets in binary files** (compiled code, images, etc.)\
β **Secrets split across multiple lines** (obfuscation techniques)\
β **Custom secret formats** without adding custom rules
## False Positive Handling
**Common false positives**:
* Example credentials in documentation
* Test API keys in test files
* Placeholder values (`YOUR_API_KEY_HERE`)
* High-entropy strings that aren't secrets
**How to reduce false positives**:
* Use `.gitleaksignore` file
* Mark test files/directories for exclusion
* CodeThreat AI can filter test secrets automatically
## Best Practices
**Never commit secrets**: Use environment variables or secret managers
**Rotate compromised secrets**: If found in Git history, consider it compromised
**Use `.gitignore`**: Prevent secrets files from being committed
**Secret managers**: AWS Secrets Manager, HashiCorp Vault, Azure Key Vault
## What's Next?
Infrastructure scanning coverage
How secrets scanning works
# Interpreting Scan Results
Source: https://codethreat.mintlify.app/scanning/interpreting-results
Understanding and acting on security scan findings
Learn how to read, prioritize, and act on security scan results effectively.
## Results Overview
After a scan completes, you'll see several views of your security posture.
### Dashboard Metrics
**Security Score** (0-100): Overall security health
* 90-100: Excellent
* 70-89: Good
* 50-69: Needs improvement
* 0-49: Critical issues
**Violation Counts by Severity**:
* Critical: Immediate attention required
* High: Significant risk
* Medium: Moderate concern
* Low: Minor improvements
* Info: Informational findings
***
## Understanding Severity Levels
**Critical** π΄:
* Actively exploitable vulnerabilities
* High CVSS (9.0-10.0) and high EPSS (>50%)
* **Action**: Fix immediately (same day)
* **Examples**: SQL injection, RCE, hardcoded admin credentials
**High** π :
* Serious security flaws
* CVSS 7.0-8.9, EPSS 20-50%
* **Action**: Fix within 1 week
* **Examples**: XSS, authentication bypass, known CVEs with high EPSS
**Medium** π‘:
* Moderate security concerns
* CVSS 4.0-6.9, EPSS \<20%
* **Action**: Fix within 1 month
* **Examples**: Information disclosure, weak crypto, outdated dependencies
**Low** π’:
* Minor security improvements
* CVSS 0.1-3.9
* **Action**: Fix when convenient
* **Examples**: Code quality issues, minor config issues
**Info** βΉοΈ:
* Informational findings
* Best practice recommendations
* No direct security impact
* **Action**: Optional improvement
***
## CVSS and EPSS Scores
### CVSS Scores
**Common Vulnerability Scoring System**: Technical severity rating (0-10).
**Components**:
* Attack Vector: Network, Adjacent, Local, Physical
* Attack Complexity: Low or High
* Privileges Required: None, Low, High
* User Interaction: None or Required
* Impact: Confidentiality, Integrity, Availability
### EPSS Scores
**Exploit Prediction Scoring System**: Likelihood of exploitation (0-100%).
**Interpretation**:
* **80-100%**: Very likely to be exploited
* **50-79%**: High exploitation risk
* **20-49%**: Moderate exploitation risk
* **0-19%**: Low exploitation risk
### Prioritization Matrix
| CVSS | EPSS High (>50%) | EPSS Medium (20-50%) | EPSS Low (\<20%) |
| ------------------- | ------------------------- | ------------------------- | -------------------- |
| **Critical (9-10)** | π₯ **P0** - Fix today | π΄ **P1** - Fix this week | π **P2** - Fix soon |
| **High (7-8.9)** | π΄ **P1** - Fix this week | π **P2** - Fix soon | π‘ **P3** - Schedule |
| **Medium (4-6.9)** | π **P2** - Fix soon | π‘ **P3** - Schedule | π’ **P4** - Backlog |
***
## Reading Violation Details
Each violation includes:
* **Code location**: File path, line numbers, code context
* **Vulnerability description**: Clear explanation of the risk
* **Impact**: What an attacker could do
* **Remediation**: Step-by-step fix guidance
* **Severity scores**: CVSS, EPSS, CWE
***
## Trends
Track security over time:
* Violations trend (increasing/decreasing)
* Security score trend
* New vs fixed violations
* Mean time to remediation
Focus on the trend, not just absolute numbers. A repository with 50 violations but declining trend is better than one with 20 violations but increasing trend.
***
## Next Steps
Triage and fix violations
Learn about violation structure
# Pull Request Scanning
Source: https://codethreat.mintlify.app/scanning/pr-scanning
Security scanning for pull requests
Get security feedback directly in pull requests to prevent vulnerable code from being merged.
## How PR Scanning Works
PR scanning analyzes only the code changes in a pull requestβfaster than full repository scans.
### Differential Analysis
CodeThreat scans:
* β
Modified files
* β
New files
* β
Changed lines and surrounding context
* β Unchanged files (skipped for speed)
**Result**: Faster scans (30 seconds to 2 minutes) with focused feedback on your changes.
***
## Enable PR Scanning
Repository β **Settings** β **Pull Requests**
Toggle **Auto-scan on PR** to enabled
* Post PR comments
* AI PR reviews
* Block merge on failure
Click **Save** to activate PR scanning
***
## PR Check Status
CodeThreat appears as a status check on pull requests:
| Status | Description | Actions |
| -------------- | ---------------------- | --------------------------------------- |
| β³ **Pending** | Scan in progress | Wait for completion (typically 1-2 min) |
| β
**Success** | No blocking violations | Safe to merge |
| β **Failed** | Security issues found | Review and fix violations |
| β οΈ **Warning** | Non-blocking issues | Consider fixing before merge |
### Pass/Fail Criteria
Configure what causes a PR check to fail:
* Fail on Critical: Yes
* Fail on High: Yes
* Fail on Medium: No
* Fail on Low: No
Start by failing only on Critical violations, then progressively tighten criteria as your security posture improves.
***
## PR Comments
When enabled, CodeThreat posts comments directly on your pull request.
### Summary Comment
Posted at the PR level with overall results:
* Security status
* Summary of violations found
* Top issues list
* Link to full results
### Inline Comments
Posted on specific lines with vulnerabilities:
* Issue description
* Security impact
* Fix recommendations
* Code examples
### Resolving Comments
1. Fix the vulnerability in your code
2. Push the fix
3. PR re-scans automatically
4. If issue is fixed, comment auto-resolves
***
## Branch Protection
Prevent merging vulnerable code with branch protection rules.
### GitHub Branch Protection
Repository β **Settings** β **Branches** β Select branch (e.g., `main`)
Enable **Require status checks to pass before merging**
Search for and select **CodeThreat Security Scan**
Click **Save changes**
***
## Best Practices
* Enable PR scanning for all repositories
* Use branch protection to enforce security gates
* Review PR comments promptly
* Fix critical issues before merging
* Use AI PR reviews for deeper analysis
***
## Next Steps
Enable intelligent PR analysis
Set up continuous scanning
# Running Scans
Source: https://codethreat.mintlify.app/scanning/running-scans
How to trigger and monitor security scans
Learn how to run security scans manually, view real-time progress, and interpret results.
## Trigger a Manual Scan
From dashboard, click on the repository you want to scan
Click **Scan Now** button in the top right
Click **Start Scan** in confirmation modal
***
## Scan Status
Scans progress through states:
| Status | What It Means | Duration |
| ------------- | ------------------------------- | ------------------ |
| **PENDING** | Scan queued, waiting for worker | Seconds to minutes |
| **SCANNING** | Actively analyzing code | 2-15 minutes |
| **COMPLETED** | Scan finished successfully | - |
| **FAILED** | Scan encountered an error | - |
### Real-Time Progress
During scanning, you'll see:
* Current phase: Cloning, SAST, SCA, Secrets, IaC
* Progress percentage: Estimated completion
* Time elapsed: How long scan has been running
* Preliminary findings: Violations as they're discovered
Most scans complete within 2-5 minutes. Large repositories may take up to 15 minutes.
***
## Scan Results Dashboard
After a scan completes, the results dashboard shows:
### Summary Metrics
Violations requiring immediate attention
Significant security issues
Moderate security concerns
Minor issues and improvements
### Breakdown by Type
See violations categorized by scan type:
* **SAST**: Code-level vulnerabilities
* **SCA**: Dependency vulnerabilities
* **Secrets**: Exposed credentials
* **IaC**: Infrastructure misconfigurations
### Security Score
A numeric score (0-100) representing overall security posture:
* **90-100**: Excellent
* **70-89**: Good
* **50-69**: Moderate risk
* **0-49**: High risk
***
## Viewing Individual Violations
Click any violation to see detailed information:
* **Violation title** and description
* **Severity** and type
* **Code location** with context
* **CVSS and EPSS scores**
* **Remediation guidance**
* **Actions**: Fix, suppress, assign, comment
***
## Scan History
View all past scans for a repository:
1. Navigate to repository
2. Click **Scan History** tab
3. See chronological list of scans
Each scan shows:
* Completion time
* Violation counts
* Security score
* Comparison to previous scan
***
## Next Steps
Understand scan results
Set up automatic scans
# Scan Types
Source: https://codethreat.mintlify.app/scanning/scan-types
Understanding SAST, SCA, Secrets Detection, and IaC Security
## Overview
CodeThreat provides comprehensive security scanning through deterministic engines and agentic analysis:
* **Deterministic SAST**: Rule-based pattern matching (SAST, SCA, Secrets, IaC)
* **Agentic SAST**: Deep AI-powered code analysis for complex vulnerabilities
* **False Positive Elimination**: Automatically filters false positives from deterministic SAST results
* **PR Reviews**: Contextual security analysis of pull requests
Find vulnerabilities in your source code
Detect vulnerable dependencies
Find exposed credentials and API keys
Scan infrastructure configurations
CodeThreat provides **Deterministic SAST** (rule-based) and **Agentic SAST** (AI-powered deep analysis). False Positive Elimination agent works on deterministic SAST results to reduce false positives. PR Review Agent provides contextual security analysis for every pull request.
***
## Deterministic Static Application Security Testing (SAST)
Deterministic SAST analyzes your source code using rule-based pattern matching to find security vulnerabilities without executing the program. Results are enhanced by **False Positive Elimination** agent and complemented by **Agentic SAST** for deep analysis.
**Powered by**: OpenGrep (enhanced Semgrep fork) + ShiftQL intelligent analysis
**Coverage**: 1,740+ security rules across 27+ languages
### What SAST Finds
* Injection flaws: SQL injection, command injection, code injection
* Cross-Site Scripting (XSS): Reflected, stored, DOM-based
* Authentication issues: Broken auth, session management flaws
* Authorization flaws: Missing access controls
* Cryptographic issues: Weak algorithms, insecure random number generation
* Security misconfigurations: Debug mode enabled, default credentials
* Input validation: Missing or improper validation
* Path traversal: Directory traversal vulnerabilities
### Languages Supported
**Deep coverage** (100+ rules each):
* Python (334 rules), Terraform (362 rules), JavaScript (173 rules)
* Java (121 rules), YAML/K8s (120 rules), Ruby (92 rules)
* Go (76 rules), PHP (61 rules), C# (51 rules), Solidity (50 rules)
**Additional support**: TypeScript, Scala, Kotlin, Swift, Rust, Elixir, OCaml, Bash, C/C++, Apex, Clojure, Dockerfile, HTML, JSON
[View complete SAST support matrix β](/reference/sast-support-matrix)
### Enhanced by Agentic Analysis
**False Positive Elimination**: Automatically filters false positives from deterministic SAST results by understanding code context, framework protections, and actual exploitability.
**Agentic SAST**: Performs deep code analysis to find complex vulnerabilities that deterministic SAST cannot detect, such as logic flaws, authorization issues, and design failures.
[Learn more about Deterministic SAST β](/platform/sast) | [Learn more about Agentic SAST β](/platform/agentic-sast)
***
## Software Composition Analysis (SCA)
SCA identifies known vulnerabilities in your dependencies and third-party libraries.
### What SCA Finds
* CVE vulnerabilities: Known security issues in dependencies
* Outdated packages: Dependencies with available security updates
* Vulnerable transitive dependencies: Issues in sub-dependencies
* License violations: Incompatible or risky licenses
* Abandoned packages: Unmaintained dependencies
### Package Managers Supported
npm, yarn, pip, Maven, Gradle, Go modules, NuGet, Composer, Bundler, Cargo, and more.
Prioritize **high CVSS + high EPSS** vulnerabilities in **direct dependencies** with **available fixes**.
***
## Secrets Detection
Secrets scanning finds exposed credentials, API keys, and sensitive data in your codebase and Git history.
### What Secrets Detection Finds
* Cloud provider credentials: AWS keys, Azure tokens, GCP service accounts
* API keys: Stripe, SendGrid, Twilio, GitHub tokens
* Database credentials: PostgreSQL, MySQL, MongoDB connection strings
* Private keys: SSH keys, TLS certificates, JWT secrets
* Passwords: Hardcoded passwords in code
* OAuth tokens: Access tokens, refresh tokens
### How It Works
1. Pattern matching: Regex patterns for known credential formats
2. Entropy analysis: High-entropy strings likely to be secrets
3. Context awareness: Reduces false positives by examining code context
4. Git history scanning: Checks all commits, not just current code
### Response Steps
If a secret is found:
1. Rotate immediately: Generate new secret, revoke old one
2. Remove from Git history: Use git-filter-repo or BFG Repo-Cleaner
3. Use environment variables: Never commit secrets
4. Enable secret management: Use Vault, AWS Secrets Manager, etc.
***
## Infrastructure as Code (IaC) Security
IaC scanning detects misconfigurations in infrastructure definitions before deployment.
### What IaC Security Finds
* Public exposure: S3 buckets, databases accessible from internet
* Missing encryption: Unencrypted storage, databases, message queues
* Overly permissive IAM: Wildcard permissions, excessive roles
* Insecure containers: Running as root, privileged mode
* Missing security groups: Unrestricted network access
* Hardcoded secrets: Credentials in IaC templates
* Insecure protocols: HTTP instead of HTTPS, outdated TLS
### IaC Formats Supported
Terraform (.tf files), Kubernetes (YAML manifests, Helm charts), Docker (Dockerfiles, docker-compose.yml), CloudFormation (AWS templates), ARM Templates (Azure resource definitions)
***
## Scan Execution
When you trigger a scan, CodeThreat:
Securely clone your repository into an isolated scanning environment
Execute deterministic scans (SAST, SCA, Secrets, IaC) in parallel
Convert all findings to standardized SARIF format
False Positive Elimination filters SAST results, Agentic SAST performs deep analysis (if enabled)
Results are stored and displayed in your dashboard
***
## Enabling/Disabling Scan Types
You can control which scan types run for each repository:
1. Go to **Repository Settings** β **Scan Configuration**
2. Toggle scan types: SAST (with False Positive Elimination), SCA, Secrets Detection, IaC Security, Agentic SAST
3. Save configuration
Running all deterministic scan types (SAST, SCA, Secrets, IaC) with Agentic SAST and False Positive Elimination provides the most comprehensive security coverage.
***
## Scan Performance
Typical scan times by repository size:
| Repository Size | Scan Duration |
| ----------------------- | ------------- |
| Small (\<100 files) | 1-2 minutes |
| Medium (100-1000 files) | 2-5 minutes |
| Large (1000+ files) | 5-15 minutes |
Factors affecting scan time:
* Number of files
* Lines of code
* Number of dependencies
* Git history depth (for secrets)
* Enabled scan types
***
## Next Steps
Trigger a scan manually
Set up continuous scanning
# Inviting Team Members
Source: https://codethreat.mintlify.app/team/inviting-members
Add team members to your CodeThreat organization
Collaborate on security by inviting team members to your CodeThreat organization.
## Invite Team Members
Go to **Organization Settings** β **Members**
Click **Invite Member** button
Add one or more email addresses (one per line or comma-separated)
Select role for invited members:
* **ADMIN**: Full administrative access
* **USER**: Standard member access (view-only for most features)
* **Custom roles**: If your organization has created custom roles
Choose repository access:
* **All repositories**: Access to all current and future repos
* **Selected repositories**: Choose specific repos
Click **Send Invitations**
Email invitations are sent immediately
## Invitation Process
### What Invited Users Receive
Email invitation with:
* Organization name
* Role assigned
* Invitation link (valid for 7 days)
* Instructions to accept
### Accepting Invitations
Invited user clicks invitation link in email
If existing user: Sign in
If new user: Create account
Review organization details and click **Accept**
User is added to organization with assigned role
## Managing Pending Invitations
### View Pending Invitations
**Organization Settings** β **Members** β **Pending Invitations** tab
Shows:
* Invited email
* Role
* Sent date
* Expiration date
### Resend Invitation
If user didn't receive invitation:
1. Find pending invitation
2. Click **Resend**
3. New invitation email sent
### Cancel Invitation
To revoke an invitation:
1. Find pending invitation
2. Click **Cancel**
3. Invitation link becomes invalid
Invitations expire after 7 days. Expired invitations must be resent.
## Bulk Invitations
Invite multiple team members at once:
```
# Enter multiple emails:
alice@company.com
bob@company.com
charlie@company.com
```
Or comma-separated:
```
alice@company.com, bob@company.com, charlie@company.com
```
All invited users receive the same role and repository access.
## Best Practices
**Assign appropriate roles**: Use principle of least privilege
**Set repository access**: Limit access to relevant repositories
**Use USER role for stakeholders**: Non-technical stakeholders typically need read-only access
**Invite via work emails**: Use company email addresses, not personal
**Review pending invitations**: Cancel expired or incorrect invitations
**Welcome new members**: Brief them on security practices and tools
## What's Next?
Understand role capabilities
Control who sees which repositories
# Repository Access Control
Source: https://codethreat.mintlify.app/team/repository-access
Manage who can access specific repositories
Control which team members can access specific repositories for fine-grained security.
## Why Repository-Level Access?
Restrict access to sensitive projects
Meet regulatory requirements
Align access with team structure
Limit exposure of security findings
***
## Default Access
By default, all organization members have access to all repositories.
Enable **Repository Access Control** to restrict access:
**Organization Settings** β **Security** β **Enable Repository Access Control**
Enabling repository access control restricts access. Team members will only see repositories explicitly granted to them or their teams.
***
## Grant Repository Access
Repository β **Settings** β **Access**
Click **Add Collaborator**
Choose individual users or teams
Choose permission:
* **Admin**: Full repository control
* **Write**: Manage findings, run scans
* **Read**: View-only access
Click **Grant Access**
***
## Permission Levels
### Admin (Repository)
**Can**:
* Configure repository settings
* Manage access control
* Run and configure scans
* Manage all violations
* Delete repository
**Use for**: Repository owners, security leads
### Write
**Can**:
* Run scans
* Assign violations
* Suppress violations
* Comment on violations
* Generate reports
**Cannot**:
* Change repository settings
* Manage access control
* Delete repository
**Use for**: Developers, security engineers
### Read
**Can**:
* View violations
* View scan results
* View reports
* Comment on violations
**Cannot**:
* Run scans
* Assign/suppress violations
* Modify anything
**Use for**: Stakeholders, managers, auditors
***
## Team-Based Access
Grant access to entire teams instead of individual users:
* Easier to manage at scale
* Access follows team membership
* Clear ownership structure
* Simplified onboarding/offboarding
***
## Access Inheritance
Final access is the combination of organization role and repository permission:
| Org Role | Repo Permission | Effective Access |
| -------- | --------------- | ------------------------------------------------ |
| ADMIN | Any | Admin (org-level ADMINs always have full access) |
| USER | Admin | Admin |
| USER | Write | Write |
| USER | Read | Read |
| USER | None | No access |
Organization-level ADMIN role members bypass repository-level restrictions and always have admin access to all repositories.
***
## Managing Access at Scale
### Bulk Grant Access
1. **Organization Settings** β **Members** β Select user
2. Click **Repository Access** tab
3. Select multiple repositories and set permission level
4. Grant access to all selected repositories
***
## Reviewing Access
### Audit Repository Access
Regularly review who has access:
1. Open repository β **Settings** β **Access**
2. Review all users and teams with access
3. Verify permission levels are appropriate
4. Remove users who no longer need access
### Access Reports
Generate access reports for compliance:
**Organization Settings** β **Reports** β **Access Report**
Shows:
* Who has access to which repositories
* Permission levels
* Last accessed date
* Access granted by whom and when
***
## Best Practices
* Enable repository access control for sensitive repos
* Use teams for easier management
* Grant least privilege: minimum required permission level
* Regular reviews: quarterly access audits
* Revoke promptly: remove access when no longer needed
* Monitor access logs: track who accesses what
***
## Troubleshooting
**User can't see repository**:
* Verify repository access control is enabled
* Check user has explicit repository access or team membership
* Organization Admins should always see all repositories
**User has wrong permission level**:
* Check both organization role and repository permission
* Effective access is combination of both
**Can't grant access**:
* Verify you have Admin access to the repository
* Only repository admins and org admins can grant access
***
## Next Steps
Understand organization roles
Track access changes
# Roles and Permissions
Source: https://codethreat.mintlify.app/team/roles-and-permissions
Understanding user roles and access control in CodeThreat
CodeThreat uses role-based access control (RBAC) to manage what team members can see and do.
## Built-In Roles
CodeThreat provides two built-in role templates:
Full access to manage organization, repositories, and team
Standard member access with read permissions
Organizations can also create custom roles with specific permissions tailored to their needs.
***
## ADMIN Role
### Capabilities
**Organization Management**:
* Manage organization settings
* Invite/remove members
* Assign roles
* Manage billing and subscription
* View audit logs
**Repository Management**:
* Connect VCS integrations
* Import/remove repositories
* Configure repository settings
* Set up automated scanning
* Configure AI features
**Security Findings**:
* View all violations
* Assign violations
* Suppress violations
* Run scans
* Generate reports
**Team Collaboration**:
* Comment on violations
* Create and share reports
* Configure notifications
### When to Use
* Organization owners
* Security team leads
* DevSecOps managers
* Anyone needing full administrative access
***
## USER Role
### Capabilities
**Security Findings**:
* View violations in accessible repositories
* View scan history and results
* View dashboards and reports
* Comment on violations
**Limitations**:
* Cannot manage organization settings
* Cannot invite/remove members
* Cannot manage billing
* Cannot connect VCS integrations
* Cannot trigger scans
* Cannot assign or suppress violations
* Cannot configure repository settings
### When to Use
* Software engineers (read-only access)
* Stakeholders
* Compliance/audit teams
* Product managers
* Anyone needing view-only access
***
## Permission Matrix
| Action | ADMIN | USER | Custom Roles |
| ------------------------- | ----- | ---- | ------------ |
| **Organization** | | | |
| Manage settings | β
| β | β |
| Invite members | β
| β | β |
| Manage billing | β
| β | β |
| **Repositories** | | | |
| Connect VCS | β
| β | β |
| Configure settings | β
| β | β |
| View repositories | β
| β
| β
|
| **Scanning** | | | |
| Trigger scans | β
| β
| β |
| View scan results | β
| β
| β
|
| Configure automated scans | β
| β | β |
| **Violations** | | | |
| View violations | β
| β
| β
|
| Assign violations | β
| β
| β |
| Suppress violations | β
| β
| β |
| Comment on violations | β
| β
| β
|
| **Reporting** | | | |
| View reports | β
| β
| β
|
| Generate reports | β
| β
| β |
| Share reports | β
| β
| β |
***
## Repository-Level Permissions
In addition to organization roles, control access to specific repositories.
### Grant Repository Access
Repository β **Settings** β **Access Control**
Click **Add Member** or **Add Team**
Choose from organization members or teams
Choose: Admin, Write, or Read
Click **Grant Access**
### Repository Permission Levels
**Admin**: Manage repository settings, run scans, manage violations, configure automation
**Write**: Run scans, assign and suppress violations, comment on violations
**Read**: View violations, view scan results, view reports
Organization-level Admins have access to all repositories regardless of repository-level permissions.
***
## Teams
Group users into teams for easier access management.
### Create a Team
**Organization Settings** β **Teams**
Click **Create Team**
Set name, description, and add members
Assign team access to repositories
### Benefits of Teams
* Simplified access management
* Organized collaboration
* Notification routing
* Ownership clarity
***
## Changing Roles
**Organization Settings** β **Members**
Find user whose role you want to change
Click role dropdown and select new role
Confirm role change
Role changes take effect immediately. Demoting an Admin means they lose access to organization settings instantly.
***
## Removing Team Members
**Organization Settings** β **Members**
Find user to remove
Click **Remove** button
Confirm removal (cannot be undone)
**What happens**:
* User loses access immediately
* Violations assigned to them remain assigned (reassign if needed)
* Comments and activity history preserved
* User is notified via email
***
## Best Practices
* **Principle of least privilege**: Assign minimum required role
* **Use teams**: Group users for easier management
* **Repository-level permissions**: Restrict sensitive repository access
* **Regular access review**: Quarterly review of user access
* **Remove departing employees**: Remove access on last day
* **Document role decisions**: Note why users have specific roles
***
## Audit and Compliance
### Audit Logs
Track all permission-related actions:
* Role assignments and changes
* User invitations and removals
* Repository access grants/revokes
* Team membership changes
Access: **Organization Settings** β **Audit Logs**
### Compliance Requirements
For compliance (SOC 2, ISO 27001, etc.):
* Regular access reviews
* Principle of least privilege
* Audit log retention
* Timely access removal
* Documented RBAC policy
***
## Next Steps
Add team members
Control repository permissions
# Common Issues
Source: https://codethreat.mintlify.app/troubleshooting/common-issues
Solutions to frequently encountered problems
Quick solutions to common problems you might encounter.
## Connection Issues
**Symptoms**: Connection fails or times out
**Solutions**:
* Verify credentials are correct
* Check network connectivity
* For self-hosted VCS, verify URL is accessible
* Check firewall allows outbound HTTPS
* Try disconnecting and reconnecting
**Symptoms**: Connected VCS but repositories don't show
**Solutions**:
* Verify you have admin access to repositories
* For organizations, ensure OAuth app is approved
* Check repositories aren't archived
* Re-authorize the VCS connection
* Refresh repository list
## Scanning Issues
**Symptoms**: Scan doesn't start, stays pending
**Solutions**:
* Wait 5-10 minutes (scans may queue during busy times)
* Check plan scan limits aren't exceeded
* Verify workers are online (contact support)
* Cancel and restart scan
**Symptoms**: Scan shows FAILED status
**Solutions**:
* Check scan error message for details
* Verify repository is accessible
* Check repository isn't too large (>10GB)
* Ensure no corrupted files
* Try scanning again
**Symptoms**: Many violations are false positives
**Solutions**:
* Enable AI false positive elimination
* Increase AI filtering aggressiveness
* Exclude test directories from scans
* Manually suppress false positives with justification
* Contact support for custom rules
## Violation Issues
**Symptoms**: Fixed code but violation still shows as OPEN
**Solutions**:
* Trigger new scan to detect fix
* Verify fix actually resolves the issue
* Check violation hash hasn't changed (file moved, line numbers shifted significantly)
* Manually mark as fixed if needed
**Symptoms**: Status change button doesn't work
**Solutions**:
* Verify you have ADMIN role or appropriate custom role permissions
* Check you're not in read-only demo mode
* Provide justification (required for status changes)
* Try refreshing page
## PR Integration Issues
**Symptoms**: PRs don't get scanned automatically
**Solutions**:
* Verify auto-scan on PR is enabled
* Check webhook delivery in VCS
* Ensure webhook is active
* Verify repository is connected
* Check plan limits
**Symptoms**: CodeThreat check doesn't show on PR
**Solutions**:
* Verify GitHub App is installed
* Check PR scanning is enabled
* Ensure webhook is working
* Wait a few minutes for check to appear
* Trigger scan manually
## Access Issues
**Symptoms**: Repository doesn't appear in list
**Solutions**:
* Verify repository access control settings
* Check you have required role/permission
* Ask admin to grant access
* Verify repository is connected
**Symptoms**: Can't use expected features
**Solutions**:
* Check your plan limits
* Verify feature is available in your plan
* Check organization/repository settings
* Verify you have required role
## Performance Issues
**Symptoms**: Scans taking too long
**Solutions**:
* Exclude unnecessary directories (node\_modules, vendor)
* Reduce Git history depth scanned
* Split large repositories
* Check repository size (\<5GB recommended)
* Contact support for optimization
**Symptoms**: UI is slow or unresponsive
**Solutions**:
* Clear browser cache
* Try different browser
* Check internet connection
* Reduce selected time range for reports
* Contact support if persistent
## Still Having Issues?
Detailed scan troubleshooting
VCS and integration problems
Email [support@codethreat.com](mailto:support@codethreat.com)
Join our Discord
# Integration Issues
Source: https://codethreat.mintlify.app/troubleshooting/integration-issues
Troubleshooting VCS and integration problems
Solve problems with VCS integrations and webhooks.
## VCS Connection Problems
### GitHub
**Connection fails**:
* Verify GitHub credentials
* Check organization OAuth approval
* For GitHub Enterprise, verify URL and network access
* Try OAuth instead of PAT, or vice versa
**Repositories not showing**:
* Verify admin access to repositories
* Grant organization access (for OAuth)
* Check repositories aren't archived
### GitLab
**Connection fails**:
* Verify token scopes are correct
* For self-hosted, check URL format and SSL certificate
* Ensure network connectivity
### Azure DevOps
**Connection fails**:
* Verify PAT permissions
* Check organization name is correct
* Ensure PAT hasn't expired
### Bitbucket
**Connection fails**:
* Verify app password permissions
* Check username (not email)
* For Server, verify base URL and network access
## Webhook Issues
### Webhooks Not Firing
**Scans not triggering on push**:
1. **Check webhook delivery**:
* View webhook delivery logs in VCS
* Look for failed deliveries (non-200 responses)
2. **Verify webhook is active**:
* Ensure webhook is enabled
* Check webhook URL is correct
3. **Test webhook manually**:
* Use VCS webhook test feature
* Verify successful delivery
4. **Check firewall**:
* Ensure outbound HTTPS allowed from VCS to `api.codethreat.com`
* Whitelist CodeThreat IP addresses if needed
### Webhook Deliveries Failing
**Non-200 responses**:
* Check webhook secret is correct
* Verify payload format
* Contact support with webhook delivery ID
## PR Integration Issues
### PR Checks Not Appearing
**GitHub checks missing**:
* Verify GitHub App installed
* Check auto-scan on PR is enabled
* Ensure webhook is working
* Wait a few minutes for check to appear
### PR Comments Not Posting
**Comments not appearing**:
* Verify post PR comments is enabled
* Check GitHub App has write permissions
* Ensure PR scanning completed successfully
## API Integration Issues
### Authentication Failures
**401 Unauthorized**:
* Verify API key is correct
* Check API key hasn't expired
* Ensure API key has required scopes
* Regenerate API key if compromised
### Rate Limiting
**429 Too Many Requests**:
* Slow down request rate
* Implement exponential backoff
* Contact support for rate limit increase
## What's Next?
Back to common issues
View integration guides
# Scan Problems
Source: https://codethreat.mintlify.app/troubleshooting/scan-problems
Troubleshooting scan-related issues
Detailed troubleshooting for scanning issues.
## Scan Won't Start
### Stuck in PENDING
**Possible causes**:
* Queue backlog
* Plan scan limit reached
* Worker availability
**Solutions**:
1. **Check plan usage**:
* **Settings** β **Billing** β **Usage**
* Verify you haven't hit monthly scan limit
2. **Wait for queue**:
* Scans typically start within 5 minutes
* During peak times, may take up to 10 minutes
3. **Cancel and retry**:
* Cancel pending scan
* Start new scan
4. **Contact support**:
* If pending >15 minutes, contact support with scan ID
## Scan Failures
### Repository Access Errors
**Error**: "Failed to access repository"
**Causes**:
* VCS token expired
* Repository deleted/archived
* Permissions revoked
**Solutions**:
* Reconnect VCS integration
* Verify repository exists and isn't archived
* Check access permissions
### Timeout Errors
**Error**: "Scan timed out"
**Causes**:
* Repository too large
* Too many files
* Deep Git history
**Solutions**:
* Exclude large directories (node\_modules, vendor)
* Reduce files scanned with `.codethreatignore`
* Contact support for large repo optimization
### Out of Memory
**Error**: "Scan failed: out of memory"
**Causes**:
* Very large files
* Too many dependencies
* Complex analysis
**Solutions**:
* Exclude generated files
* Split monorepo into smaller repos
* Contact support
## Incomplete Results
### Missing Violations
**Symptoms**: Expected violations not appearing
**Possible reasons**:
* AI filtered as false positive
* File/directory excluded
* Language not supported
* Insufficient rules coverage
**Check**:
1. Review AI-filtered violations
2. Check scan configuration exclusions
3. Verify language support
4. Contact support if issue persists
### Wrong Severity
**Symptoms**: Violation severity seems incorrect
**Explanation**:
* CVSS score determines severity
* EPSS score influences priority
* Severity can be overridden in enterprise plans
**Action**:
* Review CVSS/EPSS scores
* Provide feedback if genuinely incorrect
## Performance Issues
[View detailed scan performance optimization β](/scanning/scan-types#scan-performance)
## What's Next?
Back to common issues
VCS integration problems