# Code Security
Source: https://docs.infraista.com/en/developer-tools/code-security



Code Security scans your repositories on every push and pull request, and every night. Each scan
reports its result to the commit and pull request as the `infraista/security` status check, so you can
block merging when a change adds something risky.

<Shot name="developer-tools/code-security/overview" alt="The Code Security overview with the organization grade, open findings by severity, top risks, repositories and recent scans" />

## What it finds [#what-it-finds]

| Scanner             | What it checks                                                                                                                                                  |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Dependencies**    | Package lockfiles and manifests (npm, pnpm, Yarn, pip, Poetry, Go modules, Composer and more) against known advisories, with the version that fixes each one    |
| **Secrets**         | API keys, tokens, passwords and private keys committed to the code. Only the last 4 characters of a value are stored                                            |
| **IaC & config**    | Risky settings in Dockerfiles, Kubernetes manifests, Terraform and Helm charts, such as containers running as root or public buckets                            |
| **Licenses & SBOM** | Every package and its license, checked against your license policy, with an SBOM (CycloneDX and SPDX) for each scan                                             |
| **AI code review**  | Flaws in your own code (injection, broken authorization, insecure crypto), explained, with a suggested patch. Off by default; its findings never block the gate |

## Your code stays private [#your-code-stays-private]

* Each scan runs in a fresh sandbox that's destroyed when the scan finishes, and the scan container has
  no network access.
* The cloned code is deleted right after the scan. Infraista keeps findings, not your repository.
* Your code is never used to train AI models.

## Where to go next [#where-to-go-next]

<SectionIndex />