Complete Feature Reference

Every capability available in CodeScan — how each works and where to find it. This section is updated each time a new feature ships.

🔍 Scanning

AI Security Scan (5-Step Pipeline)

The core scan runs every file through a five-step pipeline: Scan → Investigate → Verify → Revalidate → Enrich. Claude Haiku scans for vulnerabilities, Claude Sonnet investigates and enriches with CVE data, and a revalidation pass removes false positives before results reach you.

• Where: Scanner → Start Scan button
• Models: Claude Haiku 4.5 (scan) · Claude Sonnet 4.5 (investigate/enrich)
• Supported: TypeScript, JavaScript, Python, Go, Java, Rust, Ruby, PHP, C/C++, C#, Kotlin, Swift, Bash, SQL, YAML, Terraform, Dockerfile

Smart Scan Cache

Each file is SHA-256 hashed before scanning. If the file hasn't changed, the cached result is returned instantly — no AI tokens consumed. Cache entries live for 24 hours in localStorage.

• Badge: Files served from cache show a "cached" indicator
• Reset: "Clear Cache & Rescan" link in the sidebar forces a fresh scan
• Auto-clear: Cache is wiped automatically when you re-fetch a remote repo (so merged fixes show up)

Batch Scanning (Small Files)

Files under 2 KB are grouped into batches of up to 5 and scanned in a single API call using Claude Haiku, reducing scan time and token cost for projects with many small utility files.

Secret Detection

Runs in parallel with the AI scan using 24 regex patterns covering API keys, database URLs, private keys, OAuth tokens, cloud credentials, and more. Results appear in the SECRETS tab.

• Supports // nosec, // noqa, // codescan-disable suppression comments
• Skips template literals (`${variable}`) to avoid false positives on dynamic connection strings

Dependency Vulnerability Scan

Detects package.json, requirements.txt, go.mod, Gemfile, and other manifests, then queries OSV.dev to check every package for known CVEs. Results appear in the DEPENDENCIES tab.

Scan Pause & Resume

During a long scan you can click ⏸ Pause to save partial results. Because of smart caching, resuming won't re-scan files already completed — it picks up exactly where it left off at zero extra token cost.

🌐 Remote Repository Import

GitHub Import

Paste an owner/repo slug or full GitHub URL into the Remote Repo field and click Fetch. CodeScan downloads all source files from the default branch (up to 60 files). Private repos require a GitHub Personal Access Token with repo scope.

Azure DevOps Import

Paste an Azure DevOps URL or org/project/repo slug. Requires a Personal Access Token (PAT) with Code Read permission.

AWS CodeCommit Import

Enter the repository name, AWS region, and IAM Access Key + Secret Key. CodeScan uses the AWS SDK to fetch repository contents.

Ultra Open

Paste any public GitHub URL directly into the GitHub URL input field — no manual slug extraction needed. CodeScan auto-detects the owner, repo, and branch from the URL and fetches the code immediately.

⚡ AI Fix

Fix Single Vulnerability

Click Fix on any finding to generate a targeted patch using Claude Sonnet 4.6. The fix is applied in-context — only the vulnerable lines change.

Fix All in File

Click Fix All on a file card to patch every vulnerability in that file in a single AI pass.

⚡ AI Fix All (Project-Wide)

The ⚡ AI Fix All button in the sidebar fixes every vulnerability across every file in one automated operation. Files are processed sequentially via a streaming SSE connection. As each file is patched, its vulnerabilities disappear from the scanner in real time.

• Progress: Live counter shown in the tab bar — "Fixing 3/12…"
• Safety: Fix prompt explicitly forbids introducing new packages or changing TypeScript types
• Availability: Starter plan and above

✦ Ultra Suite

📋 Ultra Plan

After scanning, click 📋 Ultra Plan in the sidebar to generate an AI remediation roadmap. Claude Sonnet analyses all findings and produces a prioritised markdown document structured as:

• Executive Summary — overall risk in 2–3 sentences
• Phase 1 — Fix Immediately — CRITICAL/HIGH with specific steps and estimated effort
• Phase 2 — Fix This Sprint — MEDIUM priority items
• Phase 3 — Backlog — LOW/INFO items
• Quick Wins — fixes estimated under 30 minutes

The plan opens in a full-screen modal and can be copied to clipboard in one click.

🔍 Ultra Review

Before pushing fixes to Git, click 🔍 Ultra Review fixes to have Claude Sonnet review every patched file. For each file it checks: did the fix correctly address the vulnerability? Did it break any existing functionality? Is it minimal and appropriate?

• Verdict per file: SAFE · WARNING · FAIL with confidence score 0–100
• Inline summary: Issues shown directly below the button — no modal needed
• When to use: Always run before pushing to a production branch

🛡 Ultra Security

Runs the security scanner on the fixed code (not the original) to catch any new vulnerabilities accidentally introduced by the AI patch. Unlike the main scan which looks for pre-existing issues, Ultra Security looks only for regressions.

• Result: "clean ✓" or "N new issue(s) introduced" per file
• When to use: After AI Fix All, before pushing to Git

⬆ Git Push & Commit

Push & Commit to Git (Direct)

The green ⬆ Push & Commit to Git button commits all AI-fixed files directly to your connected branch — no PR dialog, no intermediate step. Each file gets its own commit message: fix(security): patch {filename}.

• Supported: GitHub (direct commit) · Azure DevOps and CodeCommit (PR fallback)
• Appears: After AI Fix All completes and at least one file has a fix applied
• After push: "View commit on GitHub" link + Re-fetch & Rescan button

Create Pull Request (PR flow)

For teams requiring code review before merging, the PR flow creates a new branch (codescan/security-fixes-YYYYMMDD-xxxxx) and opens a pull request with a full diff description. Retries automatically up to 5 times if the branch name already exists.

Auto-Fix Build Errors on Bot PRs

A GitHub Actions workflow (.github/workflows/bot-pr-autofix.yml) runs on every CodeScan bot branch. If the Next.js build fails due to an AI-introduced error, Claude automatically reads the failing file, generates a fix, commits it to the PR branch, and re-runs the build — up to 4 times. The PR is always green before a human reviews it.

🧠 Dual-AI Verification

Claude + GPT-4o Cross-Verification

HIGH and CRITICAL findings are automatically cross-checked between Claude Sonnet and GPT-4o (when an OpenAI API key is configured). Each model independently assesses whether the finding is a real vulnerability. The consensus verdict is displayed as a badge on each finding.

• CONFIRMED — both models agree it's real
• UNCERTAIN — models disagree or low confidence
• DISPUTED — at least one model flagged it as false positive
• CLAUDE ONLY — no OpenAI key configured; single-model assessment

Configure via OPENAI_API_KEY environment variable. Gracefully degrades to single-model if the key is absent.

📊 Results & Session Management

Session Persistence

Scan results are saved to localStorage automatically. Closing the tab, refreshing the page, or restarting the browser preserves your full scan session — results, remediation status, and the active panel. Sessions expire after 7 days.

Previous Scans History

The last 5 scan sessions are stored with a 7-day TTL. Click the history icon to browse past scans and restore any of them instantly — no re-scanning, no token cost.

Resolved Vulnerabilities

Fixed, accepted, and won't-fix vulnerabilities are hidden by default (like Snyk and SonarQube). A "N resolved hidden — show" toggle reveals them. Resolving a vuln updates its status but keeps it in the history.

Regression Diff

When you re-scan a repo after fixing issues, CodeScan compares the new results against the previous scan and highlights new findings with a +N new badge and resolved findings with a N fixed badge.

📋 Compliance & Reporting

OWASP / SOC2 / PCI-DSS Reports

Generate formatted compliance reports mapping your findings to OWASP Top 10, SOC 2, and PCI-DSS control frameworks. Each report shows which controls are affected, which are passing, and provides evidence text suitable for auditors.

SBOM Export

Export a Software Bill of Materials in CycloneDX JSON or SPDX format listing all detected dependencies with their versions, licenses, and known CVEs.

SARIF Export

Export findings in SARIF format for upload to GitHub Security tab, Azure DevOps Security, or any SARIF-compatible tool.

Quality Gates

Define pass/fail thresholds (e.g. "fail if more than 0 CRITICAL findings") to block deployments or CI jobs when security standards aren't met. Configurable per severity level.

Custom Rules Engine

Write Semgrep-style custom rules in YAML to enforce project-specific security policies. Rules support pattern matching, metavariables, and multi-file analysis. Community rules are available out-of-the-box.

🗄 Database Connections

Test Connection

The Database tab includes a Test Connection button with a live status indicator (green / yellow / red dot). For Supabase, the ping uses the PostgREST REST API so it works with just the Project URL + Service Role Key — no database password or region needed.

AI Database Migrations

Describe a schema change in plain English to CodescanBot (e.g. "add a users table with email, created_at, and role columns"). The bot generates the SQL migration, which you can review and execute directly to your database from the UI.

Supported databases: PostgreSQL · Supabase · Neon · CockroachDB · MySQL · MariaDB · PlanetScale · MongoDB · SQL Server · Redis · Cassandra.

🔧 Other Features

AI Test Generation

Select a vulnerability and click Generate Test to have Claude produce a unit test that reproduces the vulnerability and verifies the fix. Tests are generated in the language of the scanned file.

README Badge

After scanning, copy a dynamic SVG badge to embed in your repository README. The badge shows the number of vulnerabilities found and links to the scan results.

Multi-Environment Scan

Scan the same codebase against multiple environment configurations (dev / staging / prod) and compare the security posture across environments side by side.

Chrome Extension

The CodeScan Chrome Extension adds a Scan with CodeScan button directly to GitHub, Azure DevOps, and AWS CodeCommit repository pages. Clicking it sends the current repo to the CodeScan scanner without leaving your browser. Unauthenticated users are redirected to the login page.

• Supports: GitHub · Azure DevOps · AWS CodeCommit
• Requires: CodeScan account (free tier works)
• Install from: Chrome Web Store — search "CodeScan AI Security Scanner"

CLI Tool

The codescan npm package provides terminal-based scanning for CI/CD integration. Install globally and scan any directory.

npm install -g codescan-flowlog
codescan scan --dir ./src --fail-on critical

Rate Limiting & Security

All authentication endpoints are protected by a sliding-window rate limiter (10 requests / 15 min per IP). The token refresh endpoint is limited to 5 requests / 15 min. Input validation uses Zod schemas on auth routes.