Code Scanning checks a Git repository for three kinds of security problem and writes a PDF report for each. You don't need a pipeline in GitHub, GitLab or Bitbucket: add the repository once, then press Scan all. Each project has its own repositories: select the project, then Code Scanning in the left menu.
| Column | Tool | What it finds |
|---|---|---|
| Leaks | Gitleaks | API keys, tokens, passwords and private keys in the code and in the last 500 commits, so a key that was deleted later is still found |
| SAST | Opengrep | Risky code: SQL and command injection, eval, XSS, disabled TLS checks, debug mode left on, secrets baked into Docker images… (JavaScript / TypeScript, PHP / Laravel, Python, Go, Java, Dockerfiles, compose files) |
| SCA | OSV-Scanner | Packages with published vulnerabilities (CVE / GHSA) in your lockfiles — npm, yarn, pnpm, Composer, pip, Poetry, Go, Cargo, Maven, Ruby — and the version that fixes each |
1. Add a Git credential (private repositories only)
Public repositories need nothing. For a private one, add a read-only token under Git credentials → Manage at the top of the page:
- GitHub: a fine-grained token with access to the repositories you scan and Contents: Read-only. Username: your GitHub username.
- GitLab: a token with
read_repository. - Bitbucket: a repository access token with Read (username
x-token-auth).
These are the same saved credentials Deploy App uses, shared by every project in your account. The token is stored encrypted and only ever sent to the host it was saved for.
2. Add a repository
Add repository → paste the repository's HTTPS clone URL
(https://github.com/acme/shop.git), check the name and branch, and pick the
credential. SSH URLs (git@github.com:…) aren't supported.
3. Scan
- Scan all clones the branch once and runs the three tools one after the other. If one fails, the others still run.
- Scan in a column runs just that tool.
- A scan of a typical repository takes 10–60 seconds. The page updates by itself.
Each new scan replaces the previous report for that tool; there is no history. If a scan fails, the error is shown with the last good report under it.
4. Read the results
Each column shows the number of findings, the tool's own severities (SAST: Error / Warning / Info; SCA: Critical / High / Medium / Low from the advisory's CVSS score), and its own groups (Leaks: by rule; SAST: by vulnerability class; SCA: by ecosystem).
- Findings opens the list: search, filter by group or severity, and click a finding for the file and line, the code, the masked secret or the upgrade to make, and links.
- PDF downloads the report. All three reports have the same layout: report details (repository, branch, the exact commit, tool and version, what was scanned), summary cards, findings by group, a findings table, then each finding in full.
A leaked secret must be rotated — revoke it and issue a new one. Deleting the line isn't enough, because the old commits still hold it.
Secrets are never shown in full: the panel keeps at most the first six characters, enough to tell which key it is.
Who can do what
| Role | Can |
|---|---|
| Viewer | See the project's repositories, findings and reports |
| Operator | Also run scans |
| Owner, Admin | Also add, edit and delete repositories and Git credentials |
Limits
- Up to 50 repositories per project, and 3 scans waiting or running at once.
- 10 scans a day on the Free plan, 50 on paid plans. Scan all counts as one.
- Scans run one at a time across all customers, so yours may wait for others first; the card shows how many are ahead.
- The repository, with its last 500 commits, must fit in 640 MB once cloned.
- Each step has a time limit: cloning 3 minutes, secrets 5, code analysis 8, dependencies 3. A step that runs out of time or memory says so on its card.
- Scheduled daily scans are coming: the Schedule button is on every repository already.
How it runs
Each scan runs in a throwaway, locked-down container on the panel server. The repository is cloned into memory, scanned and thrown away with the container; only the findings and the PDFs are kept. Nothing is installed on your servers.