Ctrlk
Book a demoOX Security
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Code Security

Code Security helps you identify security vulnerabilities, code quality issues, and unapproved SaaS usage in your source code before applications are deployed. Code Security performs static analysis of your source code. OX analyzes the code without executing it.

OX provides native Code Security scanning and can also ingest findings from external Code Security tools. OX correlates findings with application and repository context, enriches them with additional security context, and prioritizes them so teams can focus on the issues that pose the greatest risk. For more information about how OX prioritizes issues, see Issue prioritization.

What OX helps you identify

Finding type
Description

Security vulnerabilities

Identifies security vulnerabilities and insecure coding patterns in your source code, such as SQL injection (SQLi), cross-site scripting (XSS), and server-side request forgery (SSRF).

Code quality issues

Identifies code quality problems and inefficient coding patterns that can affect the quality and maintainability of your code.

Unapproved SaaS usage

Identifies the use of SaaS services in code or APIs that are not approved by your organization. For example, OX can identify code that uses a service that is not approved for use in your organization.

Code Security policies

Code Security policies determine how Code Security issues are identified and evaluated in OX. Policies cover security vulnerabilities, code quality issues, and unapproved SaaS usage.

For information about the available policies and their configuration, see Code Security policies.

How it works

  1. OX scans supported source code using the native OX Code Security scanner and ingests findings from connected Code Security tools.

  2. OX identifies and consolidates security vulnerabilities, code quality issues, and unapproved SaaS usage.

  3. For supported security findings, OX analyzes the data flow through the code from source to sink.

  4. OX correlates findings with application and repository context.

  5. OX enriches issues with context about reachability, exploitability, and potential damage, and uses this context to automatically prioritize issues according to risk.

  6. Findings are available throughout OX for investigation and remediation.

For more information about how OX prioritizes issues, see Issue prioritization.

Analyze how data flows through your code

For supported security findings, OX tracks how potentially untrusted data moves through the code from source to sink:

  • Source is where potentially untrusted data enters the application.

  • Sink is where the data is used in a potentially unsafe operation.

OX traces the complete path between the source and sink, including intermediate steps and the relevant files and lines of code. This lets you see where the data entered the application, how it moved between functions, and where it was ultimately used.

For example, in an SQL injection finding, user-controlled input may enter the application and pass through multiple functions before being used in a database operation. OX traces this path so you can understand how the untrusted input reaches the vulnerable operation.

Tracking the complete data flow helps OX determine whether a potential vulnerability is actually exploitable.

For example, untrusted input may be validated or sanitized before it reaches the sink. By analyzing the entire path, OX can identify whether such safeguards are present.

If the input is properly validated or sanitized before reaching the sink, this context can indicate that the potential vulnerability is not exploitable. If the input reaches the sink without appropriate validation or sanitization, OX can show the complete path through the code that exposes the vulnerability.

This additional context helps you distinguish exploitable vulnerabilities from findings that may otherwise be false positives, so you can focus on vulnerabilities that represent actual risk.

View the data flow

You can inspect the data flow for a specific occurrence of a Code Security finding from the issue details.

To view the data flow for a specific occurrence:

  1. On the Active Issues page, go to Filters and select Category > Code security.

  2. Open the Code Security issue.

  3. In the issue details, select the Commits tab.

  4. In the Aggregations table, locate the relevant occurrence.

  5. Hover over the Match value.

OX displays the flow associated with the match, including the source, intermediate steps, sink, and their locations in the code.

Code Security integrations

Code Security connectors connect OX to static application security testing (SAST) tools that analyze source code for vulnerabilities, coding flaws, and security weaknesses without executing the application.

Last updated