Code Security is generally available through the Cloud Security extension. Subscribing to the extension is the purchase. Paid Code Security usage costs $0.80 per protected repository per month, billed daily at $0.80/30 per repository-day on that day's protected-repository count, plus the existing Cloud Security base fee. See security product billing.
Code Security scans the source repositories behind your cloud estate and puts what it finds into the same risk-ranked worklist as your cloud findings. You triage a leaked credential or a vulnerable dependency the same way you triage a public bucket, and the same automation events fire.
It works with GitHub, GitLab.com and Bitbucket Cloud. On GitHub it can also rescan on every push, check pull requests before they merge, and open pull requests that upgrade vulnerable dependencies.
!!! tip "Ready to start?" Get started takes about ten minutes on GitHub: the console creates the GitHub App for you and turns scanning on.
Organizations with a configured sensor quota of 2 or less use Cloud Security and Code Security for free, with no trial and no expiry. Hosted scanning covers up to 10 repositories per connected source-control organization and 5 container images per organization. The other free-tier limits (user accounts, resources and connections) are described in free tier and limits.
Raising the sensor quota above 2 moves the organization to a paid plan, lifts the free-tier limits and starts usage billing.
| Engine | What it finds | Finding class |
|---|---|---|
| Dependencies (SCA) | Known vulnerabilities in packages from lockfiles and manifests, ranked by exploit data and by whether your code uses them. See Dependencies. | vulnerability |
| Malicious packages | Dependencies that match known malicious-package advisories. See Malicious packages. | malware |
| Secrets | Hundreds of credential formats, such as cloud, source control, SaaS and AI provider keys, private keys and JWTs, in the current files and, if you turn it on, in the full git history. See Secrets. | secret |
| Infrastructure as code | Misconfigurations in Terraform, CloudFormation, Kubernetes manifests, Helm charts and Dockerfiles: public exposure, missing encryption and logging, weak access settings, and container hardening. See Infrastructure as code. | misconfig |
| Static analysis (SAST) | Weaknesses in source code, such as injection, unsafe file handling, XSS, deserialization and weak cryptography, found by your organization's code rules (LimaCharlie's CWE-mapped defaults plus your own). See what the defaults look for. | code_weakness |
| Container images | Known vulnerabilities in the OS and application packages of images your repositories build from, and optionally images your workloads run, plus end-of-life base images. See Container images. | vulnerability on the image |
| Licenses | Every dependency license, rated by risk. The evidence also gives the obligation class (copyleft, weak copyleft, permissive or unknown), to help you focus on copyleft and unknown licenses. See Licenses. | license_risk |
| End-of-life runtimes | Language runtimes and base images past their vendor support date. See End-of-life runtimes. | eol_runtime |
See Supported languages and ecosystems for the full coverage of each engine.
Dependency findings name the package, the installed version and the version that fixes it. They are ranked with EPSS and CISA KEV, so a known-exploited advisory sorts above a high CVSS score nobody exploits.
Scanning code means reading it. What LimaCharlie guarantees is that it does not keep it.
- Each scan is short-lived and isolated. A fetch job downloads the commit, and a separate sandboxed container scans it and is then destroyed. Both run in your organization's data region.
- The scanner never holds your source-control credential. Only the fetch job uses it. The scan container has no cloud identity, a read-only filesystem, and network access only to LimaCharlie's storage and vulnerability database mirror.
- On GitHub, the fetch token covers one repository and expires within an hour. GitLab and Bitbucket cannot narrow a token like that, so those fetch jobs use the connection's token. That is why those connections ask for read-only scopes.
- Only the results leave the sandbox: findings, the software bill of materials and hashes. Findings never hold file contents, diffs or secret values. The commit package the scan reads, and the files AutoFix edits, are deleted when the job ends. See Data handling and privacy.
- Secrets are stored as a salted hash. No field on a finding can hold the credential itself.
- Nothing is written to your repositories unless you allow it. Pull-request checks, comments and AutoFix pull requests need write permissions you grant to the GitHub App, and each write uses a token limited to what that one action needs.
These guarantees describe ordinary scans and deterministic dependency AutoFix. The separate, currently unavailable AI-proposed fix capability has an additional opt-in for sending one target file to your model provider; see AI data handling.
In the console, open Cloud Security → Code security. It has four tabs:
| Tab | What it shows |
|---|---|
| Overview | Open findings, the repositories to look at first, the Priority fix queue (the dependency upgrades that close the most findings), scanner coverage, what each GitHub connection is allowed to do, and the GitHub webhook status. |
| Repositories | Every repository with its scan status and open findings. Select one for details, rescan it, download its SBOM, or exclude it from scanning. |
| Images | Container images, the repositories that build them and the workloads that run them. |
| Registries | Image repositories grouped by registry. |
While something is not set up yet, the page shows a Set up code security button. It opens a checklist of each capability, says what is blocking it, and links to the right setting.
Code findings also appear on Risks, where the Repository and Code source filters narrow the list.
- Get started: connect GitHub, GitLab or Bitbucket and run your first scan.
- Working with results: the console, the CLI, SBOMs, and how code findings connect to your cloud.
- Scan policy: which repositories are scanned, which engines run and how often.
- Code rules: the static-analysis rules scans run, LimaCharlie's defaults and your own.
- Pull-request checks and push rescans: scan every push and gate merges on GitHub.
- AutoFix pull requests: let LimaCharlie open dependency upgrade pull requests.
- Bring your own scanner: scan in your own CI, or push SARIF and CycloneDX results.
- What Code Security guarantees: the rules behind
verified, image lineage, runtime evidence and remediation. - Configure evidence, lineage and remediation: permissions, connections, pull-request disclosure, remediation runs and playbooks.
- Automatic behavior and incident response: what happens on its own, and how to stop or undo a remediation.
- Data handling and privacy: what is read, what is kept, retention and purge.
- Reference: languages, limits, status codes and API routes.
- Troubleshooting: common problems and how to fix them.
- Unknown, partial and refusal reasons: every reason code and what to do about it.