> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/scan-and-analyze-with-ox/scanning/custom-code-security-scanning.md).
# Custom Code Security Scanning
> **Note:**
>
> * This capability is currently in Early Access (EA) and is not generally available. To request access, please contact OX technical support.
Custom Code Security Scanning allows you to extend OX code security scans with organization-specific SAST rules.
OX includes built-in SAST rules maintained by the OX Security research team. If your organization uses proprietary frameworks, internal libraries, or coding standards that require additional security checks, you can define your own OpenGrep-compatible rules. These custom rules run together with the built-in OX SAST rules during code security scans.
Custom rules supplement the built-in OX detection logic. They do not replace or modify the default OX rules.
* Custom SAST Rules are disabled by default.
* You can configure up to 50 custom rules per organization.
* OX validates the structure of each rule before saving it. It does not validate whether the rule detects the intended code pattern. Test your rule before using it in production.
### Enable custom code scanning
To enable or disable Custom SAST Rules:
1. Go to **Settings** > **Scan Settings**.
2. Under **Code Security**, turn **Custom SAST Rules** on or off.
When the capability is disabled, OX ignores all configured custom rules during code security scans.
### Add custom code rules
1. Go to **Settings** > **Scan**.
2. Under **Code Security**, select **Add**.
3. Configure the rule.
| Setting | Description |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Rule Type** | Type of custom rule. Currently, only **SAST** is supported. |
| **Rule Name** | Internal name used to identify the rule in the **Custom SAST Rules** table. This name is not displayed in findings. |
| **Issue Name** | Name displayed for findings generated by the rule. Use a descriptive name that reflects the vulnerability or insecure coding pattern detected, such as **JavaScript Eval Function** or **Unsafe SQL Query**. |
| **Severity** | Severity assigned to findings generated by the rule. |
| **Issue Description** | Description displayed in the finding details. |
| **Issue Recommendation** | Remediation guidance displayed in the finding details. |
| **Custom Rule** | OpenGrep-compatible rule that defines the code pattern to detect. Select **Test in OpenGrep Playground** to validate the rule before adding it. |
4. Select **Add**.
The rule is added to your organization and is evaluated during subsequent code security scans.
#### Example custom rule
The following example detects JavaScript code that uses the `eval()` function.
```yaml
rules:
- id: javascript-eval
languages:
- javascript
severity: WARNING
message: message
pattern: eval(...)
```
### View and manage custom rules
The **Custom SAST Rules** table displays all configured rules.
| Column | Description |
| --------------- | ---------------------------------------------------- |
| **Type** | Rule type. Currently, only **SAST** is supported. |
| **Rule Name** | Internal name of the custom rule. |
| **Issue Name** | Name displayed for findings generated by the rule. |
| **Severity** | Severity assigned to findings generated by the rule. |
| **Description** | Description configured for the finding. |
To remove a rule, delete it from the table. Findings generated only by that rule are no longer appear in future scans.
### Review findings
Findings generated by custom SAST rules appear together with other code security findings.
**To locate these findings:**
* Filter by the **SAST** policy, and search for the **Issue Name** that you defined for the rule.
Each finding displays the custom **Issue Name**, **Severity**, **Issue Description**, and **Issue Recommendation** that you configured when creating the rule.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ox.security/scan-and-analyze-with-ox/scanning/custom-code-security-scanning.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.