▸ CODESCAN
DocsSupportScanner
WEB TOOL

Using the Web Scanner

The web tool lets you scan code directly in your browser — no installation required.

Step 1 — Upload your code

Click Drop files or click to upload in the scanner. You can upload:

  • Individual source files (e.g. app.py, index.ts)
  • A .zip archive of your project — CodeScan will extract and scan all supported files

Files are scanned in order of risk score — high-risk files first.

Step 2 — Run the pipeline

Click Run Security Scan. The 5-step AI pipeline runs automatically:

01
Scan
Deep static analysis using Claude + 22 regex patterns. Prioritises critical and high-risk files.
02
Investigate
Each critical/high finding is re-verified in context of the full file to confirm it's real.
03
Revalidate
A second AI pass removes false positives. Only confirmed findings reach you.
04
Enrich
Findings are matched to NVD CVEs, scored with EPSS exploit probability, and checked against CISA KEV.
05
Export
Results are compiled into JSON, SARIF, and GitHub Markdown formats for download.

Step 3 — Review findings

Results are grouped by file and sorted by severity. Each finding shows:

  • CRITICALHIGHMEDIUMLOW severity badge
  • File name and line number
  • CVE IDs, CVSS score, EPSS exploit probability
  • CISA KEV badge if actively exploited in the wild
  • Description, recommendation, and CWE/OWASP classification

Step 4 — Fix with AI

Click Fix on any finding to generate an AI patch for that vulnerability. Click Fix all in file to patch all fixable issues in one file at once.

The diff view shows exactly what changed. You can copy the fixed code directly.

CodescanBot

Click ◈ CodescanBot (or press Ctrl+K) to open the AI assistant. Ask questions like:

  • "Why is this SQL injection dangerous?"
  • "Show me a fix for the XSS in auth.ts"
  • "Which vulnerabilities should I fix first?"
  • "Explain the CVSS score for finding #3"