> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-code/ox-scan-engines/code-security.md).
# Code Security
Code Security helps you identify security vulnerabilities, code quality issues, and unapproved SaaS usage in your source code before applications are deployed. Code Security performs static analysis of your source code. OX analyzes the code without executing it.
OX provides native Code Security scanning and can also ingest findings from external Code Security tools. OX correlates findings with application and repository context, enriches them with additional security context, and prioritizes them so teams can focus on the issues that pose the greatest risk. For more information about how OX prioritizes issues, see [Issue prioritization](/issue-prioritization.md).
## What OX helps you identify
| Finding type | Description |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Security vulnerabilities | Identifies security vulnerabilities and insecure coding patterns in your source code, such as SQL injection (SQLi), cross-site scripting (XSS), and server-side request forgery (SSRF). |
| Code quality issues | Identifies code quality problems and inefficient coding patterns that can affect the quality and maintainability of your code. |
| Unapproved SaaS usage | Identifies the use of SaaS services in code or APIs that are not approved by your organization. For example, OX can identify code that uses a service that is not approved for use in your organization. |
## Code Security policies
Code Security policies determine how Code Security issues are identified and evaluated in OX. Policies cover security vulnerabilities, code quality issues, and unapproved SaaS usage.
For information about the available policies and their configuration, see [Code Security policies](#code-security-policies).
## How it works
1. OX scans supported source code using the native OX Code Security scanner and ingests findings from connected Code Security tools.
2. OX identifies and consolidates security vulnerabilities, code quality issues, and unapproved SaaS usage.
3. For supported security findings, OX analyzes the data flow through the code from source to sink.
4. OX correlates findings with application and repository context.
5. OX enriches issues with context about reachability, exploitability, and potential damage, and uses this context to automatically prioritize issues according to risk.
6. Findings are available throughout OX for investigation and remediation.
For more information about how OX prioritizes issues, see [Issue prioritization](/issue-prioritization.md).
## Analyze how data flows through your code
For supported security findings, OX tracks how potentially untrusted data moves through the code from source to sink:
* Source is where potentially untrusted data enters the application.
* Sink is where the data is used in a potentially unsafe operation.
OX traces the complete path between the source and sink, including intermediate steps and the relevant files and lines of code. This lets you see where the data entered the application, how it moved between functions, and where it was ultimately used.
For example, in an SQL injection finding, user-controlled input may enter the application and pass through multiple functions before being used in a database operation. OX traces this path so you can understand how the untrusted input reaches the vulnerable operation.
Tracking the complete data flow helps OX determine whether a potential vulnerability is actually exploitable.
For example, untrusted input may be validated or sanitized before it reaches the sink. By analyzing the entire path, OX can identify whether such safeguards are present.
If the input is properly validated or sanitized before reaching the sink, this context can indicate that the potential vulnerability is not exploitable. If the input reaches the sink without appropriate validation or sanitization, OX can show the complete path through the code that exposes the vulnerability.
This additional context helps you distinguish exploitable vulnerabilities from findings that may otherwise be false positives, so you can focus on vulnerabilities that represent actual risk.
## View the data flow
You can inspect the data flow for a specific occurrence of a Code Security finding from the issue details.
To view the data flow for a specific occurrence:
1. On the **Active Issues** page, go to **Filters** and select **Category > Code security**.
2. Open the Code Security issue.
3. In the issue details, select the **Commits** tab.
4. In the **Aggregations** table, locate the relevant occurrence.
5. Hover over the **Match** value.
OX displays the flow associated with the match, including the source, intermediate steps, sink, and their locations in the code.
## Code Security integrations
Code Security connectors connect OX to static application security testing (SAST) tools that analyze source code for vulnerabilities, coding flaws, and security weaknesses without executing the application.
### Supported Code Security integrations
* [Checkmarx SAST](/ox-integrations/3rd-party-integrations/code-security-static-analysis/checkmarx-sast.md)
* [Coverity](/ox-integrations/3rd-party-integrations/code-security-static-analysis/coverity.md)
* Coverity on Polaris
* Fortify on Demand
* Fortify Software Security Center
* GitHub SAST
* GitLab SAST
* [HCL AppScan](/ox-integrations/3rd-party-integrations/code-security-static-analysis/hcl-appscan.md)
* [Heeler SAST](/ox-integrations/3rd-party-integrations/code-security-static-analysis/heeler-sast.md)
* Klocwork
* OX Code Security
* Semgrep CLI
* Semgrep Enterprise
* Snyk
* SonarCloud
* SonarQube
* [Veracode](/ox-integrations/3rd-party-integrations/code-security-static-analysis/veracode.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.ox.security/ox-code/ox-scan-engines/code-security.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
