Static analysis

Find the bug before it ships. Then show why it's real.

CodesGuard SAST parses every upload into a model of how data moves through it, traces untrusted input to dangerous sinks across functions and files, and runs an AI review over each candidate — so you triage by confidence instead of wading through noise.

Contact sales Read the docs

CriticalSQL injectionCWE-89 · A03:2021FP 25% · Likely real

payments-api · internal/ledger/query.go

138func (h *LedgerHandler) Query(w http.ResponseWriter, r *http.Request) {
139  email := r.URL.Query().Get("email")
140  sql := "SELECT * FROM ledger WHERE email = '" + email + "'"
141 
142  rows, err := h.db.Query(sql)
143  if err != nil { http.Error(w, err.Error(), 500); return }

r.URL.Query()emailh.db.Query(sql)

AI review

Tainted email is concatenated into the query with no parameterization or escaping. The path from request to sink is reachable unauthenticated. Fix: use a parameterized query with $1 binding.

The question it answers

“Is there a vulnerability in the code we wrote?”

Capabilities

What SAST does

Dataflow evidence and an AI false-positive score on every finding.

Dataflow and taint tracing

Follows request parameters, form fields and headers through functions and files until they reach a database query, an HTML response or a shell command.

AI false-positive score

Every candidate gets an FP % and a verdict band — Likely real, Uncertain or Likely false positive — with the reviewer's reasoning inline. Hide the noisy tail in one click.

Three resolution tiers

Bundled framework stubs on every plan, fetched public dependency types, or a sandboxed dependency build for exact types on private code. Pick per scan or let it auto-detect.

Private package registries

Point the scanner at your internal npm, Maven or Composer registry. Credentials are write-only, held on your own scanner and used only while a scan runs.

The gate

One pass / fail verdict per project: any open critical or high fails it. Wire it in as a release check.

Evidence, not alerts

Vulnerable code with the sink highlighted, OWASP and CWE classification, reachability signals and a plain-language dataflow trace.

How it works

From input to evidence

Parse

The engine unpacks the archive, detects languages and frameworks, and builds a structural model of the code.

Trace dataflow

It follows tainted input from sources to sinks across functions and files, building the evidence path behind each candidate.

Apply rules

Security rules mapped to CWE and OWASP categories flag the risky patterns it found.

AI review

Each candidate is reviewed for exploitability and assigned a false-positive probability, with a recommended fix.

The FP score

Triage by confidence, not by luck

After the engine finds a candidate, an AI review reads the code and dataflow and assigns a false-positive probability — so a wall of alerts becomes a ranked worklist.

≤ 35 % FP

Likely real

Fix first. The review confirmed the tainted path and found no effective sanitizer.

35 – 65 % FP

Uncertain

Worth a look. The reviewer explains what would make it exploitable.

≥ 65 % FP

Likely false positive

Hidden by default with one click; very high scores are suppressed before they reach the list.

Resolution tiers

As deep as your plan allows

Higher tiers resolve types more precisely. Pick one per scan or let the engine auto-detect and fall back with a reason.

Bundled Tier A

Every plan

Bundled framework and library models. No network, no build. The floor every scan can reach.

Network Build

Fetched Tier A+

Pro and above

Fetches the exact public dependency types your project declares — no build, no secrets.

Network Build

Compiler Tier B

Pro and above

A sandboxed dependency build for private and first-party packages, giving the engine exact types.

Network Build

Languages & frameworks

JavaScriptTypeScriptPHPJavaExpressNestJSKoaFastifyNext.jsLaravelSymfonySpring

Available on

SAST is included on the plans below.

Free trialStarterProEnterpriseTalk to sales →

FAQ

SAST, in brief

Full walkthroughs live in the SAST documentation.

Do I need to connect a git repository?

No. Upload a .zip of your source tree — application code and manifests, no build artifacts. Large archives upload in chunks and are reassembled automatically.

Which languages and frameworks are covered?

JavaScript, TypeScript, PHP and Java, with framework models for Express, NestJS, Koa, Fastify, Next.js, Laravel, Symfony and Spring. The engine auto-detects what's in your upload.

Does the scanner run my build?

Only in the compiler tier, and only inside a sandbox with no network access unless you explicitly allow it. Every scan that uses internet access says so in its report.

How is noise kept down?

Findings the AI review is highly confident are false are dropped before they reach your list. Everything else carries an FP % so you can fix low-FP criticals first and skim the rest.

Next module

SCA — Software composition

Ship software you can prove is secure.

See the platform on your own code, or talk to us about a dedicated Enterprise stack.

Contact sales Explore the platform