Multi-Environment Scan

The Multi-Environment Scanner lets you scan up to four environments simultaneously — local files, multiple Git repository branches, or a mix of all three — and produces a Discrepancy Report that tells you exactly where your code has drifted, which vulnerabilities exist across all environments, and which ones are unique to a single environment. Think of it as a security diff between your local, staging, and production codebases.

What you need before you start

How it works — the 4-step flow

Step 1 — Open the Multi-Environment Scanner

1. Go to codesscan.com/multi-scan
2. Or click ⊕ Multi-Env in the top-right of the main scanner

Step 2 — Add environments

Click the environment type buttons at the bottom of the page to add environments. You can mix and match types freely.

Labelling environments

Each environment card has an editable label field. Give each environment a meaningful name so the report is easy to read:

Step 3 — Scan all environments

Click ⊕ Scan All N Environments. The button is enabled only when all environments have their required fields filled in.

While scanning, each environment card shows a live progress bar and status:

Step 4 — Read the Discrepancy Report

Once all scans finish, the Discrepancy Report appears automatically below the configuration. It has three sections:

Summary statistics

Environment grade cards

Each environment gets a security grade (A–F), score (/100), and severity breakdown. Remote environments have an Open in Scanner → button that opens the main scanner pre-configured for that environment so you can apply AI fixes immediately.

File-by-file discrepancies

Every file with an issue is listed with a status badge. Click any file row to expand it and see the per-environment vulnerability breakdown side by side.

Expanded file detail

Clicking a file row shows a side-by-side panel for each environment where the file exists. Each panel shows:

• The environment's grade and score for that file
• Every vulnerability with its severity (color-coded)
• Vulnerabilities that appear in ALL environments are shown in grey — these are common to all
• Vulnerabilities unique to this environment are shown in orange — environment-specific drift
• A Fix [env] → button for each remote environment with issues, opening the scanner pre-configured

Step 5 — Fix vulnerabilities across environments

At the bottom of the report, a Fix All banner lists every remote environment that has open vulnerabilities with a direct link to open it in the main scanner. Each link pre-configures the scanner with that environment's credentials and branch so you can apply AI fixes and create a Pull Request in one flow.

1. In the report, click Fix [Environment Name] (N) →
2. The main scanner opens with that environment already fetched and scanned
3. Click any vulnerability → ⚡ Apply AI Fix to patch the code
4. Click ⎇ Create Fix PR to open a Pull Request on that branch
5. Repeat for each environment until all branches are patched
6. Re-run the multi-env scan to confirm all environments are now consistent

Exporting the report

Click ⬇ Export Markdown to download a .md file containing the full discrepancy report. The file includes:

• Summary table with all metrics
• Environment grade table (grade, score, vuln counts per env)
• Every drifted/vulnerable file with per-environment vulnerability lists
• Highlighted common vulnerabilities

Paste it into a GitHub issue, Jira ticket, or team wiki to assign fixes across your team.

# CodeScan Multi-Environment Security Report
Generated: 14 May 2026, 09:15

## Summary
| Metric                     | Value |
|----------------------------|-------|
| Total files                | 47    |
| Drifted files              | 12    |
| Env-only files             | 3     |
| Vulnerabilities in all envs| 4     |
| Environment-specific vulns | 11    |

## Environment Grades
| Environment | Type   | Grade | Score  | Total | Critical | High |
|-------------|--------|-------|--------|-------|----------|------|
| Local Dev   | Local  | B     | 84/100 | 3     | 0        | 2    |
| Staging     | GitHub | C     | 71/100 | 8     | 1        | 3    |
| Production  | GitHub | F     | 42/100 | 15    | 3        | 7    |

Developer guide — common workflows

Workflow 1: Verify a security fix was deployed to all branches

1. Add your dev branch as Environment 1 (GitHub, branch: develop)
2. Add your main branch as Environment 2 (GitHub, branch: main)
3. Scan both
4. Look for DRIFTED files — if a file is clean in develop but vulnerable in main, the fix has not been merged to production yet

Workflow 2: Pre-deployment security check

1. Upload your local uncommitted files as Environment 1 (Local Files)
2. Add your production branch as Environment 2 (GitHub, branch: main)
3. Scan both
4. Files that are DRIFTED may introduce new vulnerabilities when deployed — review each one before pushing

Workflow 3: Multi-team codebase audit

1. Add up to 4 microservice repositories, one per environment card
2. Label them by service: Auth Service, Payment API, User Service, Notification Worker
3. Scan all
4. VULNERABLE (red) files that appear across multiple services indicate shared libraries with the same flaw — fix the shared dependency, not each service individually
5. Export the markdown report and create one Jira epic per common vulnerability, assigning sub-tasks per service team

Workflow 4: CI/CD drift detection

Integrate the multi-env scan into your pipeline using the CLI. Run it on every deployment to catch environment drift before it reaches production:

# .github/workflows/multi-env-check.yml
name: Multi-Environment Drift Check

on:
  push:
    branches: [main, develop, staging]

jobs:
  drift-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install CodeScan CLI
        run: npm install -g codescan-flowlog

      - name: Scan local working copy
        run: |
          codescan scan --dir ./src \
            --output local-scan.json \
            --save-history
        env:
          CODESCAN_TOKEN: ${{ secrets.CODESCAN_TOKEN }}

      - name: Scan production branch
        run: |
          codescan github scan ${{ github.repository }} \
            --branch main \
            --output prod-scan.json \
            --verbose
        env:
          CODESCAN_TOKEN:  ${{ secrets.CODESCAN_TOKEN }}
          GITHUB_TOKEN:    ${{ secrets.GITHUB_TOKEN }}

      - name: Upload both reports
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: security-reports
          path: |
            local-scan.json
            prod-scan.json

      # Open the multi-scan UI and compare manually, or use the API
      # to automate discrepancy detection in future pipeline iterations

Limits and performance

Troubleshooting

Quick reference cheatsheet

# ── Open Multi-Env Scanner ────────────────────────────────────────────
# codesscan.com/multi-scan
# OR: click ⊕ Multi-Env in the scanner header

# ── Configure environments (2–4) ──────────────────────────────────────
# 📁 Local Files      Upload source files from your machine
# ⎇  GitHub           owner/repo + branch + token (optional for public)
# ◈  Azure DevOps     org/project/repo + branch + PAT
# ⬡  AWS CodeCommit   repo-name + region + branch + access-key + secret

# ── Status indicators during scan ─────────────────────────────────────
# Fetching files…      Connecting to repo and downloading file tree
# Scanning N/M files…  AI pipeline running, N files done out of M
# ✓ Done — N vulns     Scan complete, N vulnerabilities found
# ✕ Error              Credentials / network problem — see error message

# ── Discrepancy report status badges ──────────────────────────────────
# DRIFTED     File exists everywhere but content or vulns differ
# ENV-ONLY    File missing from some environments
# VULNERABLE  Same vulnerability in all environments (fix everywhere)
# CLEAN       No issues in any environment

# ── Fix workflow ───────────────────────────────────────────────────────
# 1. Click "Fix [env] →" on a drifted file to open that env in scanner
# 2. Apply AI fixes, create PR for that branch
# 3. Repeat for each environment
# 4. Re-run multi-env scan to confirm all envs are now consistent

# ── Export ────────────────────────────────────────────────────────────
# Click ⬇ Export Markdown → paste into Jira / GitHub Issues / wiki