INTEGRATIONS

Integrations

CodeScan connects to your existing tools so findings go where your team already works — without switching tabs or copying data manually.

⎇GitHub

Post a formatted scan summary as a PR comment. Findings appear inline on the diff via SARIF upload to the GitHub Security tab.

#Slack

Send a Block Kit message to any channel after a scan. Includes score, grade, gate status, and severity breakdown.

JJira

Automatically create Bug tickets for critical and high findings. One ticket per finding with full ADF description.

⬡VS Code

Scan the active file with Ctrl+Shift+S. Findings appear as squiggly lines in the editor and in the Problems panel.

GitHub — PR comments & SARIF

Add --pr-comment to automatically post results to the open PR. The CLI reads GITHUB_TOKEN, GITHUB_REPOSITORY, and the PR number from GITHUB_REF automatically when running in GitHub Actions.

codescan scan --dir ./src --pr-comment --sarif-out results.sarif
# Env vars needed (auto-set in GitHub Actions):
# GITHUB_TOKEN, GITHUB_REPOSITORY, GITHUB_REF

The PR comment shows score, grade, gate status, and a collapsible table of the top 10 findings. SARIF is uploaded to the Security tab so each finding appears at the exact line in the diff. See the Quality Gates section for the full GitHub Actions workflow.

Slack

Pass a webhook URL via --slack-webhook or set the SLACK_WEBHOOK_URL environment variable. A Block Kit message is posted at the end of every scan.

Setup — create a Slack webhook

Go to api.slack.com/apps → Create New App → From scratch
Enable Incoming Webhooks and add a webhook to your channel
Copy the webhook URL — it starts with https://hooks.slack.com/services/…

CLI usage

# Inline flag
codescan scan --dir ./src --slack-webhook https://hooks.slack.com/services/XXX/YYY/ZZZ

# Environment variable (recommended for CI)
export SLACK_WEBHOOK_URL=https://hooks.slack.com/services/XXX/YYY/ZZZ
codescan scan --dir ./src --gate

GitHub Actions

- name: Run CodeScan
  run: npx codescan-flowlog scan --dir ./src --gate --pr-comment
  env:
    CODESCAN_TOKEN:   ${{ secrets.CODESCAN_TOKEN }}
    GITHUB_TOKEN:     ${{ secrets.GITHUB_TOKEN }}
    SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

Example Slack message

🔍 CodeScan Security Report

Target

`./src`

Score

🟢 88/100 — Grade B ✅ Gate PASSED

Files scanned

Total findings

🟠 High: 1 · 🟡 Medium: 2 · Scanned in 8.4s · codesscan.com

Server-side Slack API

You can also call the notification endpoint from any tool or webhook:

POST https://codesscan.com/api/notify/slack
Content-Type: application/json

{
  "webhookUrl": "https://hooks.slack.com/services/XXX/YYY/ZZZ",
  "summary": {
    "target": "./src",
    "score": 88, "grade": "B", "gatePassed": true,
    "totalVulnerabilities": 3,
    "critical": 0, "high": 1, "medium": 2, "low": 0,
    "kevCount": 0, "scannedFiles": 12, "scanDurationMs": 8400
  }
}

Jira

CodeScan creates one Jira Bug ticket per finding at or above your configured severity. Each ticket includes the file location, severity, CWE/OWASP tags, description, and recommendation — formatted in Atlassian Document Format.

Required environment variables

JIRA_BASE_URLhttps://your-domain.atlassian.net

JIRA_PROJECTSEC (your project key)

JIRA_EMAILyou@company.com

JIRA_API_TOKENYour Jira API token — generate at id.atlassian.com/manage-profile/security/api-tokens

CLI usage

# Via environment variables (recommended)
export JIRA_BASE_URL=https://acme.atlassian.net
export JIRA_PROJECT=SEC
export JIRA_EMAIL=you@acme.com
export JIRA_API_TOKEN=your-token

codescan scan --dir ./src --jira-severity high --jira-max 10

# Or pass everything as flags
codescan scan --dir ./src \
  --jira-url https://acme.atlassian.net \
  --jira-project SEC \
  --jira-email you@acme.com \
  --jira-token your-token \
  --jira-severity critical \
  --jira-max 5

Jira flags reference

Flag	Env var	Default	Description
--jira-url	JIRA_BASE_URL	—	Jira cloud base URL
--jira-project	JIRA_PROJECT	—	Project key (e.g. SEC, DEV)
--jira-email	JIRA_EMAIL	—	Atlassian account email
--jira-token	JIRA_API_TOKEN	—	Atlassian API token
--jira-severity	—	high	Minimum severity to create tickets for
--jira-max	—	10	Max tickets created per scan

Server-side Jira API

POST https://codesscan.com/api/notify/jira
Content-Type: application/json

{
  "config": {
    "baseUrl":    "https://acme.atlassian.net",
    "email":      "you@acme.com",
    "apiToken":   "your-token",
    "projectKey": "SEC",
    "minSeverity": "high",
    "maxIssues":   10
  },
  "findings": [ /* JiraFinding[] */ ]
}

# Response
{ "created": ["SEC-142", "SEC-143"], "skipped": 4 }

VS Code extension

The CodeScan VS Code extension scans the active file on demand and shows findings as squiggly underlines directly in the editor — critical and high as red errors, medium as yellow warnings.

Install

# From the VS Code Marketplace
ext install codescan.codescan

# Or build from source (vscode/ directory in the repo)
cd vscode
npm install
npm run compile
# Then: F5 to launch Extension Development Host

Authentication

The extension reads your token from ~/.codescan/config.json — the same file written by codescan login. No extra setup needed if you have already logged in via the CLI. You can also set the token directly in VS Code settings.

Commands

Command	Shortcut	Description
CodeScan: Scan Current File	Ctrl+Shift+S	Scan the active file and show findings as diagnostics
CodeScan: Scan Workspace	—	Scan all code files in the workspace folder
CodeScan: Clear Findings	—	Remove all CodeScan diagnostics from the editor
CodeScan: Open Settings	—	Jump to CodeScan settings

Settings

// .vscode/settings.json
{
  "codescan.apiUrl":      "https://codesscan.com",
  "codescan.token":       "",           // leave blank to use codescan login token
  "codescan.scanOnSave":  false,         // auto-scan on every file save
  "codescan.minSeverity": "low"          // critical | high | medium | low | info
}

Full CI/CD example — all integrations together

# .github/workflows/codescan.yml
- name: Run CodeScan
  run: |
    npx codescan-flowlog scan \
      --dir ./src \
      --gate \
      --sarif-out results.sarif \
      --compliance-out compliance.html \
      --pr-comment \
      --save-history
  env:
    CODESCAN_TOKEN:    ${{ secrets.CODESCAN_TOKEN }}
    GITHUB_TOKEN:      ${{ secrets.GITHUB_TOKEN }}
    SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
    JIRA_BASE_URL:     ${{ secrets.JIRA_BASE_URL }}
    JIRA_PROJECT:      SEC
    JIRA_EMAIL:        ${{ secrets.JIRA_EMAIL }}
    JIRA_API_TOKEN:    ${{ secrets.JIRA_API_TOKEN }}

- name: Upload SARIF
  if: always()
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

- name: Upload compliance report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: compliance-report
    path: compliance.html