Security scans

Start a scan

1. Open Security in the dashboard.
2. Pick a repository and, if you like, a branch. Codzee scans its latest commit.
3. The first time, an admin confirms your organization owns the repositories (or is allowed to scan them) and accepts the scanning terms.
4. Watch the progress on the Security page. You'll get an email and a notice in the dashboard when it's done.

Admins start scans. Everyone in your organization can see the results and download the reports. Scans run when you start one; they don't run on a schedule or on every pull request.

What a scan checks

Your repository can't hide findings from a scan: ignore files and “allow” comments for these tools aren't used.

Read the findings

• Severity: Critical, High, Medium, Low or Info.
• CVSS score for vulnerable packages, when the advisory has one. It's the industry's 0–10 rating of how bad a vulnerability is.
• CWE for secrets, Python issues and AI findings: the standard name for that kind of weakness. Vulnerable packages are tagged OWASP A06 (vulnerable and outdated components).
• Status: New, Still open or Fixed, compared with the repository's last scan.
• A fix for each finding: the version to upgrade to, or what to change in the code.

Reports

Every scan has a PDF report you can share with your team, a customer or an auditor. It shows what was scanned (repository, branch, commit, date and who started it), how many findings there are of each severity, every finding with a link to the code and how to fix it, and what was fixed since the last scan. A JSON report has the same findings for your own tools.

A scan reads your code. It isn't a penetration test: it doesn't test your running app or servers, and it can't promise your code has no vulnerabilities.

Fix pull requests

For a vulnerable npm package, an admin clicks Fix, checks what will change, and Codzee opens a pull request. It upgrades the package to the nearest safe version, updates the lockfile, and puts the change on a new codzee/fix-… branch. When your CI finishes, Codzee comments whether it passed. The next scan confirms the fix.

• Works with npm 9–11, pnpm 8–10 and Yarn 1, including workspaces.
• Only small upgrades (patch or minor versions), never a major one.
• Nothing is installed, built or run.
• Codzee never pushes to an existing branch and never merges. You review and merge the pull request.
• The first time, an admin turns fix pull requests on for the organization.

If Codzee can't fix something (another language, a major upgrade, or a problem in your own code), it tells you why and how to fix it yourself.

Limits

How your code is handled

• The repository is copied into an isolated sandbox, which is deleted when the scan ends.
• Codzee can only read your code during a scan, and that access is removed as soon as the code is downloaded.
• Your code is never run.
• Only findings and reports are kept. A finding can quote a few lines of code; secrets are never stored.
• The AI review sends the files it checks to the same AI provider Codzee uses for your code reviews.
• Findings and reports follow your data retention, and are deleted when you delete the repository's data.

More in Security and data handling, or see the security scanning overview.