Upload a .zip of your source tree — application code and manifests. Large archives upload in chunks and reassemble automatically.

Upload a docker save archive; OS packages and installed language dependencies are checked against the distribution's advisories.

Point the scanner at your internal npm, Maven or Composer registry. Credentials are write-only and used only while a scan runs.

Connect your repositories and scan on push or pull request across GitHub, GitLab, Bitbucket and Azure DevOps.

A pass/fail verdict per project — any open critical or high fails it. Call it from any pipeline as a release check.

Attach the JVM agent with a single -javaagent flag and a project token; runtime findings stream back as your tests run.

Add CodesGuard as a step in Jenkins, GitHub Actions, GitLab CI or Azure Pipelines.

Start scans, read findings and manage projects over an authenticated REST API. Available on every plan.

New findings — including hourly dependency-advisory re-checks — are delivered to the webhook endpoints you choose.

Route new findings to the mailboxes your team already watches.

See findings inline in your editor with the VS Code and JetBrains extensions.

Pull findings through the API or export them as CSV / JSON to load into your tracker of choice.

Create and update tickets in Jira, ServiceNow and Azure Boards as findings change.

Each project's bill of materials downloads as CycloneDX or SPDX (JSON), with every package's identifier and licence.

Exploitability statements export as OpenVEX so downstream consumers know which advisories actually affect you.

The vulnerable-dependency list and findings export as CSV or JSON for your own reporting.

SAML/OIDC single sign-on for your whole workspace. Available on Enterprise.

An exportable record of workspace activity, with retention that scales by plan.

Stream findings and audit events to your SIEM or SOAR.