Custom Code Security Scanning

Note:

• This capability is currently in Early Access (EA) and is not generally available. To request access, please contact OX technical support.

Custom Code Security Scanning allows you to extend OX code security scans with organization-specific SAST rules.

OX includes built-in SAST rules maintained by the OX Security research team. If your organization uses proprietary frameworks, internal libraries, or coding standards that require additional security checks, you can define your own OpenGrep-compatible rules. These custom rules run together with the built-in OX SAST rules during code security scans.

Custom rules supplement the built-in OX detection logic. They do not replace or modify the default OX rules.

• Custom SAST Rules are disabled by default.

• You can configure up to 50 custom rules per organization.

• OX validates the structure of each rule before saving it. It does not validate whether the rule detects the intended code pattern. Test your rule before using it in production.

Enable custom code scanning

To enable or disable Custom SAST Rules:

1. Go to Settings > Scan Settings.

1. Under Code Security, turn Custom SAST Rules on or off.

When the capability is disabled, OX ignores all configured custom rules during code security scans.

Add custom code rules

1. Go to Settings > Scan.

2. Under Code Security, select Add.

1. Configure the rule.

Setting	Description
Rule Type	Type of custom rule. Currently, only SAST is supported.
Rule Name	Internal name used to identify the rule in the Custom SAST Rules table. This name is not displayed in findings.
Issue Name	Name displayed for findings generated by the rule. Use a descriptive name that reflects the vulnerability or insecure coding pattern detected, such as JavaScript Eval Function or Unsafe SQL Query.
Severity	Severity assigned to findings generated by the rule.
Issue Description	Description displayed in the finding details.
Issue Recommendation	Remediation guidance displayed in the finding details.
Custom Rule	OpenGrep-compatible rule that defines the code pattern to detect. Select Test in OpenGrep Playground to validate the rule before adding it.

1. Select Add.

The rule is added to your organization and is evaluated during subsequent code security scans.

Example custom rule

The following example detects JavaScript code that uses the eval() function.

rules:
  - id: javascript-eval
    languages:
      - javascript
    severity: WARNING
    message: message
    pattern: eval(...)

View and manage custom rules

The Custom SAST Rules table displays all configured rules.

Column	Description
Type	Rule type. Currently, only SAST is supported.
Rule Name	Internal name of the custom rule.
Issue Name	Name displayed for findings generated by the rule.
Severity	Severity assigned to findings generated by the rule.
Description	Description configured for the finding.

To remove a rule, delete it from the table. Findings generated only by that rule are no longer appear in future scans.

Review findings

Findings generated by custom SAST rules appear together with other code security findings.

To locate these findings:

• Filter by the SAST policy, and search for the Issue Name that you defined for the rule.

Each finding displays the custom Issue Name, Severity, Issue Description, and Issue Recommendation that you configured when creating the rule.