> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scan Types

> Understanding SAST, SCA, Secrets Detection, and IaC Security

## Overview

CodeThreat provides comprehensive security scanning through deterministic engines and agentic analysis:

* **Deterministic SAST**: Rule-based pattern matching (SAST, SCA, Secrets, IaC)
* **Agentic SAST**: Deep AI-powered code analysis for complex vulnerabilities
* **False Positive Elimination**: Automatically filters false positives from deterministic SAST results
* **PR Reviews**: Contextual security analysis of pull requests

<CardGroup cols={2}>
  <Card title="SAST" icon="code">
    Find vulnerabilities in your source code
  </Card>

  <Card title="SCA" icon="box">
    Detect vulnerable dependencies
  </Card>

  <Card title="Secrets" icon="key">
    Find exposed credentials and API keys
  </Card>

  <Card title="IaC" icon="cloud">
    Scan infrastructure configurations
  </Card>
</CardGroup>

<Note>
  CodeThreat provides **Deterministic SAST** (rule-based) and **Agentic SAST** (AI-powered deep analysis). False Positive Elimination agent works on deterministic SAST results to reduce false positives. PR Review Agent provides contextual security analysis for every pull request.
</Note>

***

## Deterministic Static Application Security Testing (SAST)

Deterministic SAST analyzes your source code using rule-based pattern matching to find security vulnerabilities without executing the program. Results are enhanced by **False Positive Elimination** agent and complemented by **Agentic SAST** for deep analysis.

**Powered by**: OpenGrep (enhanced Semgrep fork) + ShiftQL intelligent analysis

**Coverage**: 1,740+ security rules across 27+ languages

### What SAST Finds

* Injection flaws: SQL injection, command injection, code injection
* Cross-Site Scripting (XSS): Reflected, stored, DOM-based
* Authentication issues: Broken auth, session management flaws
* Authorization flaws: Missing access controls
* Cryptographic issues: Weak algorithms, insecure random number generation
* Security misconfigurations: Debug mode enabled, default credentials
* Input validation: Missing or improper validation
* Path traversal: Directory traversal vulnerabilities

### Languages Supported

**Deep coverage** (100+ rules each):

* Python (334 rules), Terraform (362 rules), JavaScript (173 rules)
* Java (121 rules), YAML/K8s (120 rules), Ruby (92 rules)
* Go (76 rules), PHP (61 rules), C# (51 rules), Solidity (50 rules)

**Additional support**: TypeScript, Scala, Kotlin, Swift, Rust, Elixir, OCaml, Bash, C/C++, Apex, Clojure, Dockerfile, HTML, JSON

[View complete SAST support matrix →](/reference/sast-support-matrix)

### Enhanced by Agentic Analysis

**False Positive Elimination**: Automatically filters false positives from deterministic SAST results by understanding code context, framework protections, and actual exploitability.

**Agentic SAST**: Performs deep code analysis to find complex vulnerabilities that deterministic SAST cannot detect, such as logic flaws, authorization issues, and design failures.

[Learn more about Deterministic SAST →](/platform/sast) | [Learn more about Agentic SAST →](/platform/agentic-sast)

***

## Software Composition Analysis (SCA)

SCA identifies known vulnerabilities in your dependencies and third-party libraries.

### What SCA Finds

* CVE vulnerabilities: Known security issues in dependencies
* Outdated packages: Dependencies with available security updates
* Vulnerable transitive dependencies: Issues in sub-dependencies
* License violations: Incompatible or risky licenses
* Abandoned packages: Unmaintained dependencies

### Package Managers Supported

npm, yarn, pip, Maven, Gradle, Go modules, NuGet, Composer, Bundler, Cargo, and more.

<Warning>
  Prioritize **high CVSS + high EPSS** vulnerabilities in **direct dependencies** with **available fixes**.
</Warning>

***

## Secrets Detection

Secrets scanning finds exposed credentials, API keys, and sensitive data in your codebase and Git history.

### What Secrets Detection Finds

* Cloud provider credentials: AWS keys, Azure tokens, GCP service accounts
* API keys: Stripe, SendGrid, Twilio, GitHub tokens
* Database credentials: PostgreSQL, MySQL, MongoDB connection strings
* Private keys: SSH keys, TLS certificates, JWT secrets
* Passwords: Hardcoded passwords in code
* OAuth tokens: Access tokens, refresh tokens

### How It Works

1. Pattern matching: Regex patterns for known credential formats
2. Entropy analysis: High-entropy strings likely to be secrets
3. Context awareness: Reduces false positives by examining code context
4. Git history scanning: Checks all commits, not just current code

### Response Steps

If a secret is found:

1. Rotate immediately: Generate new secret, revoke old one
2. Remove from Git history: Use git-filter-repo or BFG Repo-Cleaner
3. Use environment variables: Never commit secrets
4. Enable secret management: Use Vault, AWS Secrets Manager, etc.

***

## Infrastructure as Code (IaC) Security

IaC scanning detects misconfigurations in infrastructure definitions before deployment.

### What IaC Security Finds

* Public exposure: S3 buckets, databases accessible from internet
* Missing encryption: Unencrypted storage, databases, message queues
* Overly permissive IAM: Wildcard permissions, excessive roles
* Insecure containers: Running as root, privileged mode
* Missing security groups: Unrestricted network access
* Hardcoded secrets: Credentials in IaC templates
* Insecure protocols: HTTP instead of HTTPS, outdated TLS

### IaC Formats Supported

Terraform (.tf files), Kubernetes (YAML manifests, Helm charts), Docker (Dockerfiles, docker-compose.yml), CloudFormation (AWS templates), ARM Templates (Azure resource definitions)

***

## Scan Execution

When you trigger a scan, CodeThreat:

<Steps>
  <Step title="Clone Repository">
    Securely clone your repository into an isolated scanning environment
  </Step>

  <Step title="Run All Scan Types">
    Execute deterministic scans (SAST, SCA, Secrets, IaC) in parallel
  </Step>

  <Step title="Process Results">
    Convert all findings to standardized SARIF format
  </Step>

  <Step title="Apply Agentic Analysis">
    False Positive Elimination filters SAST results, Agentic SAST performs deep analysis (if enabled)
  </Step>

  <Step title="Store and Display">
    Results are stored and displayed in your dashboard
  </Step>
</Steps>

***

## Enabling/Disabling Scan Types

You can control which scan types run for each repository:

1. Go to **Repository Settings** → **Scan Configuration**
2. Toggle scan types: SAST (with False Positive Elimination), SCA, Secrets Detection, IaC Security, Agentic SAST
3. Save configuration

<Note>
  Running all deterministic scan types (SAST, SCA, Secrets, IaC) with Agentic SAST and False Positive Elimination provides the most comprehensive security coverage.
</Note>

***

## Scan Performance

Typical scan times by repository size:

| Repository Size         | Scan Duration |
| ----------------------- | ------------- |
| Small (\<100 files)     | 1-2 minutes   |
| Medium (100-1000 files) | 2-5 minutes   |
| Large (1000+ files)     | 5-15 minutes  |

Factors affecting scan time:

* Number of files
* Lines of code
* Number of dependencies
* Git history depth (for secrets)
* Enabled scan types

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Run Your First Scan" icon="play" href="/scanning/running-scans">
    Trigger a scan manually
  </Card>

  <Card title="Automated Scanning" icon="repeat" href="/scanning/automated-scanning">
    Set up continuous scanning
  </Card>
</CardGroup>