Analysis engines

CodeStax combines specialized deterministic analyzers with bounded AI enrichment. Customer-facing results use the branded names below; engine implementation details can change without changing the finding contract.

SAST Analyzer

Type: Static Application Security Testing Languages: 30+ including Python, JavaScript, TypeScript, Java, Go, Ruby, PHP, C#, Kotlin, Swift, Rust, and more

Version pinned: rules + engine pinned in the scanner container; see Reproducibility for how pinning, deterministic fallbacks, and bounded AI-enrichment cache keys support reproducible scoring where enabled.

The SAST engine performs pattern-based static analysis to find vulnerabilities in your source code.

What It Finds

• Injection flaws - SQL injection, XSS, command injection, LDAP injection
• Authentication issues - Hardcoded credentials, weak password handling
• Cryptographic failures - Weak algorithms, insecure random, missing encryption
• Access control - Path traversal, insecure direct object references
• Security misconfigurations - Debug mode enabled, verbose error handling
• OWASP Top 10 - Full coverage of the most critical web application security risks

Rule Coverage

• OWASP Top 10 rules
• CWE (Common Weakness Enumeration) mapped rules
• Language-specific security patterns

Dependency Analyzer

Type: Software Composition Analysis Ecosystems: npm, pip, Maven, Gradle, Go modules, Cargo, Composer, RubyGems, NuGet

The SCA engine scans your dependency manifests to find known vulnerabilities (CVEs) in third-party packages. It also runs three additional sub-scanners in the same pass:

• License compliance - every package’s license, categorized by risk (HIGH/MEDIUM/LOW). Surfaces copyleft-in-permissive-project + unknown-license situations. Emitted as type: "license" findings.
• Secret analysis - detects hardcoded credentials in the analyzed dependency context and emits redacted secret findings.
• CVE enrichment - every CVE is cross-referenced with NVD (full advisory text), CISA KEV (actively-exploited flag + remediation deadline), and EPSS (30-day exploitation probability percentile). All three signals fuse into the priority score.

What It Finds

• Known CVEs - Vulnerabilities published in the National Vulnerability Database
• Outdated packages - Dependencies with newer versions available
• License issues - Dependencies with incompatible or copyleft licenses
• Transitive dependencies - Vulnerabilities in packages your dependencies depend on

Supported Files

All major package manifest formats are supported.

Secret Detection Engine

Type: Credential and secret scanning

The Secrets engine scans your repository for accidentally committed secrets.

What It Finds

• API keys - Cloud provider keys, payment service tokens, messaging platform credentials, and more
• Passwords - Hardcoded passwords in configuration files
• Tokens - OAuth tokens, JWTs, personal access tokens
• Private keys - SSH keys, TLS certificates
• Database URLs - Connection strings with embedded credentials

Smart Filtering

CodeStax applies intelligent filtering to reduce false positives, including placeholder detection, test file exclusion, and example file filtering.

IaC Security Analyzer

Type: Infrastructure-as-Code security

The IaC engine scans your infrastructure configuration files for security misconfigurations.

Supported Formats

What It Finds

• Open security groups - Unrestricted inbound/outbound rules
• Unencrypted storage - S3 buckets, EBS volumes without encryption
• Public access - Resources exposed to the internet
• Missing logging - CloudTrail, access logs not enabled
• Weak IAM policies - Overly permissive roles and policies

Container Security Analyzer

Type: Dockerfile linting and security analysis

What It Finds

• Insecure base images - Using latest tag, non-official images
• Running as root - Missing USER directive
• Package pinning - Unpinned apt-get install commands
• Layer optimization - Best practices for Docker layer caching
• Security best practices - COPY vs ADD, health checks, signal handling

Dockerfile analysis

Type: Dockerfile best-practice linting Runs in: Deep scans only

Scans Dockerfiles for established best-practice violations, security issues, and configuration problems such as running as root, missing health checks, and inefficient layer caching.

What It Finds

• Running as root - Missing or incorrect USER directives
• Missing health checks - No HEALTHCHECK instruction defined
• Inefficient layer caching - Commands that invalidate Docker cache unnecessarily
• Unpinned versions - apt-get install without version pinning
• Unsafe practices - Using ADD instead of COPY, curl | bash patterns

Output

Each finding includes a rule code such as DL3006 or SC2086, a source location, and remediation guidance. Findings are categorized as IaC issues in scan results.

Code Quality Analyzer

Code quality runs alongside security in Smart and Deep repository scans. Dependency-only SCA scans skip quality analysis. Complexity, maintainability, dead-code, duplication, and coverage signals feed one finding stream, A–E ratings, and SQALE technical-debt estimates when quality evidence is available. See Quality ratings.

Multi-language cyclomatic complexity

Type: Multi-language cyclomatic complexity Languages: 20+ - C, C++, Java, C#, JavaScript, TypeScript, Go, Ruby, PHP, Swift, Scala, Rust, Kotlin, Lua, Objective-C, GDScript, Erlang, Solidity, TTCN-3, Fortran, and more

Flags functions where cyclomatic complexity exceeds the configured threshold (default: medium ≥ 15, high ≥ 20, critical ≥ 25). Rank A–F is reported per function (A = 1–5, F = 31+).

Python complexity and maintainability

Type: Python-specific complexity + maintainability What: Python cyclomatic complexity and maintainability index from 0–100, where values below 20 indicate high maintainability risk

Cognitive Complexity - Python

Type: SonarSource cognitive-complexity metric (complements cyclomatic with nesting/control-flow cost) Language: Python via cognitive_complexity package Thresholds: medium ≥ 15, high ≥ 25, critical ≥ 35

Cognitive complexity models how humans experience code difficulty - nested branches cost exponentially more than flat ones. Better proxy than cyclomatic for “how readable is this function?”

Python dead code

Type: Dead-code detection for Python What it finds: Unused imports, unused variables, unused functions, unused classes, unused attributes Confidence filter: default 80% (configurable per-org)

TypeScript and JavaScript dead code

Type: TS/JS dead-code detector What it finds: Unused files, unused exports, unused types, unused enum members, unused class members, duplicate exports Runs when: repo has package.json

Code duplication

Type: Multi-language copy-paste detector Thresholds: min 6 lines, 50 tokens (configurable) Summary: if total duplication exceeds 5%, a repo-level summary finding is emitted (used by the duplication_pct_max quality gate).

Coverage ingestion

Type: Test coverage ingestion Formats: LCOV (lcov.info), Cobertura XML (coverage.xml), JaCoCo XML (jacoco.xml), Clover XML (clover.xml) Auto-detect paths: coverage/lcov.info, coverage.xml, jacoco.xml, clover.xml + common CI-artifact locations

Two paths to get coverage in:

1. Upload via API - POST a report to /quality/coverage/upload from your CI pipeline. 25 MB cap.
2. Auto-detect - scanner walks the cloned repo for known coverage-artifact filenames and parses any matches.

Coverage drives the new_coverage_min quality gate, the “Coverage” rating (A–E), and surfaces as coverage_gap findings on files below 60% coverage. See Coverage Ingestion + Coverage.

AI Attack Surface Analyzer

The AI Attack Surface Analyzer passively discovers AI providers, models, frameworks, prompts, agents, tools, MCP servers, vector databases, guardrails, and exposed application routes. It maps evidence to the OWASP Top 10 for LLM Applications 2025, builds a relationship graph, and reports complete, partial, failed, unverified, or not-applicable coverage.

The analyzer never executes repository code or installs dependencies. Incomplete runs preserve the last reconciled inventory instead of treating missing evidence as removal. See AI Attack Surface Management.

AI triage

CodeStax can enrich eligible findings with governed AI analysis to help assess exploitability, draft remediation guidance, map controls, and reason about reachability. AI enrichment is bounded by tenant policy, provider availability, payload limits, and deterministic fallbacks; findings still retain scanner-produced evidence when AI is disabled, skipped, or unavailable.

Where AI enrichment runs, requests use deterministic settings where supported and cache by stable inputs such as rule, code/content hash, model route, prompt version, and policy context. That improves repeatability for unchanged inputs, while deterministic scanner findings and fallback scoring remain the baseline for reproducible re-scans. See Reproducibility.