Do I need to connect a repo first?

Yes. The repo must be connected and scan-ready - assigned to a project with a branch chosen - via Integrations before you can run a scan.

Can I run all three dimensions at once?

Yes, the scan wizard lets you pick one or more dimensions to run against the same repo in one pass.

What happens if I try to start a scan that's already running?

FlawPilot prevents duplicate concurrent jobs for the same repo and dimension, so you won't queue the same scan twice.

Does the secrets scan check my whole history, or just the current files?

The full git history, not just what's currently checked out - a secret committed and later removed is still found.

Is scanning triggered automatically on push or on a schedule?

Not yet. Scans are started manually through the 3-step wizard: pick a repo, pick a dimension, run.

What can I download from a scan job?

The raw report for any completed job, and a CycloneDX SBOM for dependency (SCA) scan runs.

Code Scan

Scan your source code, not just your live site

FlawPilot now also scans a connected repository across three independent dimensions: code security, exposed secrets, and vulnerable dependencies. Pick a repo, pick a dimension, run the scan.

Run a code scan View documentation

The repo must be connected and scan-ready (project and branch assigned) via Integrations first.

Three scan dimensions, scored independently

Code security (SAST)

Flags SQL and command injection, XSS, hardcoded credentials, weak cryptography, path traversal, and unsafe deserialization.

Exposed secrets

Finds API keys and tokens, database passwords, and private keys or certificates - scanning your full git history, not just the current files.

Vulnerable dependencies (SCA)

Surfaces known CVEs in direct and transitive dependencies, reports the version each one is fixed in, and produces a downloadable CycloneDX SBOM.

What each scan looks for

Three independent scans, each scored on its own, so a clean dependency tree does not mask a hardcoded secret.

Code securityInsecure code

Injection, XSS, weak cryptography, path traversal, and unsafe deserialization, matched against your source.

SecretsExposed secrets

API keys, tokens, database passwords, and private keys - across your full git history, not just current files.

DependenciesVulnerable dependencies

Known CVEs in direct and transitive packages, with the version each is fixed in and a CycloneDX SBOM.

What a finding looks like

Every finding lands with a severity, the exact file and line, and the rule that matched - so triage starts with a location, not a search.

acme/checkout-apimain

Completed

Critical

High

Medium

Low

CriticalSQL injection in user lookup
src/api/users.ts:42javascript.express.sql-injection
Suggested fix Replace the interpolated query with a parameterised statement - pass `userId` as a bound value rather than concatenating it into the SQL string.
HighAWS access key committed to history
.env.backup:3aws-access-token
Suggested fix Rotate the key in IAM immediately, then purge it from history - the file is deleted, but the credential is still readable in older commits.
MediumPrototype pollution in lodash 4.17.15
package-lock.jsonCVE-2020-8203 - fixed in 4.17.19
Suggested fix Upgrade lodash to 4.17.19 or later. No API changes are needed between these versions.
LowWeak hash used for a non-secret digest
src/utils/cache.ts:18javascript.crypto.weak-hash
Suggested fix Switch to SHA-256. If this digest is genuinely non-security-critical, mark it as an accepted risk so it stops appearing in triage.

Illustrative example. Real findings come from your own repository.

AI remediation

Every finding comes with the fix

A location tells you where the problem is. FlawPilot also tells you what to do about it - a concrete, copy-paste-ready change for each finding, written against the code that actually matched.

The exact change

Not "sanitise your input" - the parameterised query, the upgraded version, the config line, written for your file.

Why it matters

A plain-language explanation of what an attacker could do with the flaw, so you can judge what to fix first.

Proof it landed

Re-run the scan after the change and the finding clears, so a fix is verified rather than assumed.

See AI fixes

How it works

Pick a repo

Choose from your connected, scan-ready repositories - each one needs a project and branch assigned first.

Pick a dimension

Run code security, secrets, or dependency scanning - individually or together. A duplicate job for the same repo and dimension can't run while one is already in progress.

Review the findings

Each completed job reports a Critical/High/Medium/Low breakdown and a findings list, open for triage by default. Download the raw report, or the SBOM for a dependency scan.

Good to know

A repo must be connected and scan-ready (project and branch assigned) via Integrations before it can be scanned.
Scans are triggered manually, through a 3-step wizard - there's no scheduled or push-triggered scanning yet.
A repo-level dashboard sums findings across the three dimensions' latest jobs; a cross-repo Findings list is also available.
A failed job shows its failure reason and can be re-run.

Frequently asked questions

Code security (SAST) for insecure code patterns like injection and hardcoded credentials; exposed secrets across your full git history; and vulnerable dependencies (SCA) with CVEs, fixed-in versions, and a CycloneDX SBOM.

Ready when you are

Scan your first repository

Connect a repo, pick a dimension, and see the findings - scored and triageable, right alongside your site scans.

Run a code scan