CODESCANBOT

CodescanBot — AI Security Assistant

CodescanBot is an AI security engineer built directly into the scanner. It has full context on every vulnerability you've scanned — CVE data, CVSS scores, EPSS exploit probability, CISA KEV status — and can explain, prioritise, and apply fixes directly to your files, both in the web scanner and on your local filesystem via the CLI.

◈Context-aware answers

Knows the exact vulnerability, file, line, CVE IDs, CVSS score, and exploit maturity. Answers are specific to your code — not generic advice.

⚡Apply fixes in the UI

Calls the AI fix engine directly when you ask. The patched file updates in the scanner instantly — no copy-paste required.

🔍Attack simulation

Explains exactly how an attacker would exploit the vulnerability and what the real-world blast radius is.

⬡Security test generation

Writes a failing test that proves the bug exists and a passing test that proves the fix works, in your language's test framework.

Opening CodescanBot

Click the ◈ CodescanBot button in the scanner header
Press Ctrl + K anywhere in the scanner
Click ◈ Ask CodescanBot for plan in the risk widget
Click any quick-action chip (Why dangerous?, Show the fix, etc.) in the vulnerability detail panel

Context — what the bot knows

When you select a vulnerability, CodescanBot automatically receives:

Vulnerability title & severitySQL Injection — CRITICAL

File & line numbersrc/auth.ts:42

CWE categoryCWE-89 — SQL Injection

OWASP mappingA03:2021 — Injection

CVSS score9.8 — CRITICAL

EPSS probability4.3% chance of exploitation in 30 days

CISA KEV statusNot in KEV / Actively exploited

Full file contentEnables the bot to apply fixes directly

Quick Actions

When a vulnerability is selected, the bot panel shows five quick-action chips:

Action	What it does
⚡ Apply fix	Triggers the AI fix engine. The bot applies the patch to your file in the scanner immediately — no button clicks needed. Appears only when file content is loaded.
Why dangerous?	Explains the attack scenario — what an attacker can do with this vulnerability and the real-world blast radius.
Show the fix	Displays BEFORE and AFTER code with an explanation of every change made. Use this to review before applying.
How urgent?	Synthesises CVSS, EPSS, and CISA KEV status into a concrete prioritisation recommendation.
OWASP context	Maps the finding to the OWASP Top 10, explains what the category means, and gives OWASP's recommended remediations.

How auto-fix works in the web UI

When you ask CodescanBot to apply a fix (or click ⚡ Apply fix), the following happens automatically:

Claude analyses the vulnerability

The bot reads the full file content and the vulnerability metadata (title, CWE, line, description, recommendation) to understand exactly what needs to change.

Claude calls the apply_security_fix tool

Rather than just describing the fix in text, Claude invokes a tool that executes the fix generation engine — the same engine as the ⚡ Apply AI Fix button.

Fix is generated

A separate AI call generates the minimal patch: only the vulnerable line(s) are changed, preserving all other functionality.

File updated in the scanner

The fixed content is sent back to the browser and applied to the scan results. The diff view shows exactly what changed.

Claude confirms

The bot continues the conversation describing what was changed and why, so you can review before committing.

Applying fixes to your local filesystem — CLI

To let the AI fix engine write patches directly to your codebase (not just in the web UI), use the CLI. No configuration beyond logging in is required.

Step 1 — Install the CLI

npm install -g codescan-flowlog

Step 2 — Log in

codescan login
# Enter your codesscan.com email and password
# Session saved to ~/.codescan/config.json

Step 3 — Fix a single file

Scans the file, generates AI patches for all auto-fixable vulnerabilities, and writes the fixed version. The original is overwritten by default.

codescan fix ./src/auth.ts

# To review before overwriting:
codescan fix ./src/auth.ts --output ./src/auth.fixed.ts
diff ./src/auth.ts ./src/auth.fixed.ts

Step 4 — Fix an entire directory automatically

The autofix command is the CLI equivalent of CodescanBot — it scans every file in a directory, generates patches for all findings above the severity threshold, and writes them back to disk with no manual steps.

# Scan and fix all high+ findings
codescan autofix --dir ./src

# Only critical
codescan autofix --dir ./src --severity critical

# Dry run first — see what would change without writing
codescan autofix --dir ./src --dry-run

# Apply after reviewing the dry run
codescan autofix --dir ./src

Typical workflow

# 1. Dry run to review
codescan autofix --dir ./src --dry-run

# 2. Apply fixes
codescan autofix --dir ./src

# 3. Review the diff
git diff

# 4. Run your test suite
npm test

# 5. Commit
git add -A && git commit -m "fix: apply CodescanBot security patches"

Example conversation

YOU

Fix the SQL injection vulnerability in auth.ts

◈ CODESCANBOT

⚙ Applying fix...

✅ Fix applied to src/auth.ts.

**What changed:** Replaced string interpolation in the getUserById query with a parameterised placeholder. The user-supplied id is now passed as a bound parameter, preventing any SQL metacharacter from being interpreted by the database engine.

**Before:**
```typescript
const q = `SELECT * FROM users WHERE id = ${id}`;
```
**After:**
```typescript
const q = 'SELECT * FROM users WHERE id = $1';
db.query(q, [id]);
```

YOU

Generate a security test for this fix

◈ CODESCANBOT

Here are two Jest tests — one proving the vulnerability existed, one proving the fix works:

```typescript
// Failing test (passes when code is VULNERABLE)
it('is vulnerable to SQL injection', async () => {
  const result = await getUserById("1' OR '1'='1");
  expect(result).not.toBeNull(); // vulnerable: returns all rows
});

// Passing test (passes after FIX is applied)
it('rejects SQL injection', async () => {
  const result = await getUserById("1' OR '1'='1");
  expect(result).toBeNull(); // fixed: parameterisation blocks injection
});
```

Plan requirements

Feature	Plan required
CodescanBot chat (ask questions, explain vulnerabilities)	Free
Bot auto-fix in web UI (⚡ Apply fix)	Starter
CLI codescan fix (single file)	Starter
CLI codescan autofix (batch, writes to disk)	Starter
AI security test generation	Starter
CVE / CVSS / EPSS / CISA KEV enrichment in chat	Starter / Pro