Code Security
Find it, prioritize it by real exploitability, gate the release, and open the fix PR.
What does Offload Security's code security (SAST, SCA, secrets, IaC) cover?
Repository and uploaded-code scanning across every layer — static analysis, dependencies, secrets, infrastructure-as-code, and supply chain — turned into governed, auditable release decisions with fix automation.
Code Security in the Offload Platform
What this replaces
Application security findings pile up in scanner outputs nobody owns: unreachable dependency CVEs drown the exploitable ones, secrets slip through, and 'did we ship it anyway?' has no auditable answer.
What Offload does
Repository and uploaded-code scanning across every layer — static analysis, dependencies, secrets, infrastructure-as-code, and supply chain — turned into governed, auditable release decisions with fix automation.
What you get
- SAST (OpenGrep, Bandit, optional SonarQube) with in-context code excerpts on every finding
- SCA backed by OSV.dev and Grype, enriched with CISA KEV and EPSS on every finding
- Known-malicious package detection (OpenSSF MAL advisories) and typosquat detection — both can block release
- Import-level reachability classification to cut dependency noise (advisory; never weakens the gate)
- Secrets detection with Gitleaks (~150 curated rules + entropy), fingerprinted and triageable
- IaC scanning with Checkov: Terraform, CloudFormation, Kubernetes, Dockerfile, Helm
- Deterministic, versioned release gates enforceable as required GitHub commit statuses
- Automated fix pull requests — pushed to a dedicated fix branch, never the base branch
- Governed triage: risk acceptance with owner/justification/expiry; false positives with reviewer evidence
- GitHub and Bitbucket with encrypted tokens; ZIP upload for air-gapped code; CI/CD API keys
How it works
Repositories are shallow-cloned into an isolated, scan-scoped workspace with hardened git settings; scanners run locally and the workspace is deleted when the scan completes — on success and on failure. Only findings and small per-finding code excerpts are retained, never the source tree.
Release-gate evaluation is deterministic and policy-versioned: the same scan against the same policy always yields the same pass/review/fail decision, with blocking rule identifiers recorded — an audit-defensible answer to 'why did this ship?'.
One platform, one risk view
Code findings share the unified vulnerability queue, mint supply-chain and license violations into the risk register, and appear alongside cloud and Kubernetes findings in a single per-repository report.
Solutions built on Code Security
SaaS & Technology
Code-to-cloud coverage with release gates in CI, SBOMs your enterprise customers ask for, and security-questionnaire automation that turns procurement reviews from weeks into hours — all in one governed risk view.
SBOM & license governance
Generate, ingest and police SBOMs, classify licenses into six families with a policy gate, and produce NOTICE files legal can ship — so supply-chain questions have an answer before due diligence asks them.
Other modules on the platform
Unified Vulnerability Management
One queue, one lifecycle, one history — across every scanning domain.
Cloud Security (CSPM)
Continuous multi-cloud posture across AWS, GCP, and Azure.
Dynamic Application & API Security Testing (DAST)
Test running web apps and APIs the way an attacker would — authenticated, in one pass.
Code Security — frequently asked questions
Which code scanners does Offload Security run?
SAST (OpenGrep, Bandit, optional SonarQube), SCA (OSV.dev + Grype, enriched with CISA KEV and EPSS), secrets detection (Gitleaks), and IaC scanning (Checkov for Terraform, CloudFormation, Kubernetes, Dockerfile and Helm).
Can Offload block a release with vulnerable code?
Yes. Deterministic, policy-versioned release gates can be enforced as required GitHub commit statuses, and known-malicious or typosquatted packages can block release outright.
Does Offload open fix pull requests?
Yes — automated fix PRs are pushed to a dedicated fix branch, never the base branch, so remediation is reviewable.