Platform overview
One workspace. Every layer of defense.
Static, dependency, dynamic, runtime and autonomous testing, tied together by scoped engagements, isolated environments and a single findings queue.
Shift left and right
Cover the whole lifecycle, in the same place
Catch issues early in the code, then validate what's actually exploitable in the running system.
Code & dependencies
SAST and SCA read the source and its manifests — no running system required.
SAST · SCA
The running app
DAST and IAST test the assembled system, from the outside and the inside.
DAST · IAST
A real attacker
AI Pentest reasons about what it found and proves how far an attacker could get.
AI Pentest
Engagements & runs
Nothing runs unauthorized
Dynamic testing hits a live system, so CodesGuard makes you scope and authorize it first. DAST and AI Pentest run against an engagement — a scoped, ownership-verified program — never an ad-hoc URL.
Why there's no “target” box
Targets live on an engagement so they can be verified once and reused safely across every run — with a recorded authorization and a defined scope.
- 1
Create and attest
Name the engagement, pick a scope template and record the authorization attestation.
- 2
Add and verify targets
Domains, URLs, IPs or CIDR ranges. Each passes DNS ownership verification before it can be scanned.
- 3
Capture a login
Optional. Drive a streamed remote browser through your real sign-in — MFA and SSO included — and CodesGuard keeps the session for replay.
- 4
Launch a run
When the stack is healthy, the attestation is recorded and every target is verified, DAST and AI Pentest are one click away.
Unified findings
Five modules, one queue
The Findings page brings every result into one filterable list, with a severity breakdown and a by-source split. A weakness seen from several angles is deduplicated into a single, prioritized issue.
- CriticalSASTCWE-89
SQL query built from unsanitized input
payments-api · query.go:142
- CriticalSCACVE-2021-44228
Remote code execution via a vulnerable dependency
identity-service
- HighAI PentestProven
IDOR on invoice export — cross-tenant read
GET /api/invoices/{id}/export
- HighDASTCWE-79
Reflected XSS in search parameter
shop.acme.example · /search
- MediumIASTObserved
SQL injection confirmed on refund lookup
POST /v1/refunds
Isolated environments
Your scans run in your own sandbox
Dynamic work executes inside a per-workspace tenant, isolated from everyone else, pinned to known tool versions.
Isolated per workspace
Dynamic scans run in your own tenant — a private namespace with its own attack tooling, AI gateway and scanner. SAST uses the shared engine and needs no sandbox.
Pinned and reproducible
Each environment pins the exact image versions of its tooling, so results are comparable over time and you always know what ran.
Health gates runs
If a service is degraded, the scans that depend on it won't start. Reprovision rebuilds the stack; refresh confirms it came back healthy.
Security & trust
We hold the map of where you're weak. We act like it.
CodesGuard stores source code and vulnerability data — some of the most sensitive material a team has. The controls that protect it are built in, not bolted on.
Security & trustOwnership verified
Every target passes DNS verification before a scan can touch it.
Two-factor by TOTP
Authenticator-based 2FA and one-time backup codes on every account.
Roles & invitations
Workspace roles, invites and per-workspace isolation keep teams and clients separate.
Write-only credentials
Registry and session secrets are shown once, held on your scanner, never echoed back.
The modules
Go deeper on any one
Ship software you can prove is secure.
See the platform on your own code, or talk to us about a dedicated Enterprise stack.