Skip to Content
FAQ

Frequently Asked Questions

General

What is CodeStax?

An AI-powered code security platform that scans repositories for vulnerabilities, insecure dependencies, exposed secrets, and infrastructure misconfigurations. Integrates with GitHub and Bitbucket for automated security on every commit and pull request.

What languages does CodeStax support?

30+ languages for SAST (Python, JavaScript, TypeScript, Java, Go, Ruby, PHP, C#, Kotlin, Swift, Rust, and more). 9 ecosystems for SCA (npm, pip, Maven, Gradle, Go, Cargo, Composer, RubyGems, NuGet). See Scanner Details for the full list.

Is my code stored on CodeStax servers?

Full repository checkouts are cloned into isolated scan workspaces and removed after processing. PR reviews do store changed-file names and unified diff patches per review attempt so CodeStax can render current or historical diffs and ground findings and governed review chat. Those diff records are authenticated, tenant-scoped, and follow the associated organization review record. Findings, summaries, evidence, scores, and other derived records are also retained under the applicable product and account controls. See PR Review AI Privacy & BYOK.

What network services can receive repository data?

CodeStax accesses the connected version-control provider to clone repositories and read pull-request metadata. Scanner workers can also reach package registries and vulnerability sources needed by enabled analyzers. Bounded PR review context reaches an AI provider only when the effective organization or repository policy enables that exact route; CodeStax fails closed rather than silently substituting another provider or credential.

Are AI chat cleanup times guaranteed deletion deadlines?

No. A completed review-chat answer is encrypted and becomes ineligible for replay when its server-reported eligibility window ends. Cleanup targets the next scheduled run, currently on a five-minute cadence. Delayed work is treated as cleanup debt until a successful run removes it, so the cadence and derived 15-minute figure are operating targets rather than hard physical-deletion guarantees.

What happens when I request account deletion?

The request enters the grace period shown in the product and is then handled by scheduled deletion. Tenant-owned records follow the relevant account, organization, repository, and review ownership rules. Residual backups follow infrastructure-provider lifecycle and access controls; CodeStax does not publish an exact 90-day backup-purge guarantee.

What does CodeStax put in operational logs?

Where implemented, structured logs use bounded request, correlation, service, and outcome metadata for diagnosis. Credential values, source prompts, and provider answers are not intended log fields. Audit records and retained product evidence are separate from transient operational logs and follow their own tenant access and retention controls.

Does CodeStax work with private repositories?

Yes. When you connect your GitHub or Bitbucket account, CodeStax uses your OAuth tokens to securely access private repositories.

Scanning

What’s the difference between Smart Scan and Deep Scan?

Smart Scan - Fast, runs SAST + Code Quality. Best for PRs and daily checks. Deep Scan - Thorough, adds all security engines plus AI enrichment. Best for releases and audits. See Smart vs Deep Scans.

How long does a scan take?

Smart Scan completes in minutes. Deep Scan takes longer for thorough analysis. Scans that remain in a pending or running state for an extended period are automatically marked as failed.

Can I exclude files from scanning?

Yes. Configure exclude paths for each repository in the SCA settings.

PR Reviews

How do I enable automated PR reviews?

Import a repository, enable Auto-scan on Push, and open a pull request - CodeStax reviews it automatically. See PR Reviews.

What does the risk score mean?

0–24 = Low, 25–49 = Medium, 50–74 = High, 75–100 = Critical. See PR Reviews for details.

API & CI/CD

How do I get an API key?

Go to Settings → API Keys → Generate New Key. The key is shown only once. See API Authentication.

Can I trigger scans from CI/CD?

Yes:

curl -X POST \
  -H "X-API-Key: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"type": "smart"}' \
  https://codestax.co/api/scans/trigger/{repo_id}

See API Endpoints for the full reference.

Billing

Can I try CodeStax for free?

Yes. The Free plan includes repositories, scans, and basic SAST - no credit card required.

What happens when I hit my scan limit?

You can’t trigger new scans until the limit resets next billing period, or you upgrade. See Plans & Billing.

How does per-seat pricing work?

You pay per user. Scan limits scale per seat with generous limits that grow with your plan tier.

Support

How do I get help?

Glossary