Source code analysis (SAST)
Review repository code for secret exposure and unsafe security patterns.
Start a source assessment
Connect GitHub or GitLab first, then add and authorize a Code repository asset.
- Find the repository in Asset inventory.
- Choose Source code analysis (SAST).
- Select Run assessment and open View findings when it finishes.
What results mean
Source analysis checks retrieved files for credential exposure, injection patterns, unsafe cryptography and configuration weaknesses. Matches require manual validation. It does not prove that a vulnerable path is reachable or exploitable.
Review scope
Analysis uses supported files retrieved from the default branch and has file-count and size limits. It is not a review of every branch, commit or historical secret. Run SCA separately for supported dependency lockfiles.