A live-site scan sees what a visitor sees. A code scan reads the code itself - so it catches the injection path, the committed API key, and the vulnerable package before any of it reaches production.
For acme/checkout-api
Static analysis reads your source for the patterns that turn into incidents - SQL and command injection, XSS, weak cryptography, path traversal, unsafe deserialization. Every finding lands with the file, the line, and the rule that matched, so triage starts at a location instead of a search.
src/api/users.ts:42 - the query interpolates `userId` instead of binding it.
src/jobs/export.ts:88 - user input reaches exec() unescaped.
src/utils/cache.ts:18 - MD5 where SHA-256 is expected.
Deleting a key from a file does not remove it from the repository - it stays readable in every earlier commit. The secrets scan walks your full history, not just the current checkout, so a credential someone removed months ago is still surfaced while it is still live.
.env.backup:3 - the file is deleted, the credential is not.
config/staging.yml:12 - plaintext connection string.
deploy/id_rsa - an unencrypted RSA private key.
Known CVEs across direct and transitive packages, each reported with the version it is fixed in - so the remediation is a version bump you can act on, not a CVE id you have to go research. Every scan also produces a downloadable CycloneDX SBOM.
CVE-2020-8203 - fixed in 4.17.19, no API changes needed.
Pulled in three levels deep; fixed upstream in 6.5.4.
Two majors behind; worth planning, not urgent.
Connect a repo, pick a dimension, and see the findings - scored and triageable, right alongside your site scans.
