Security & trust
We hold the map of where you're weak. We act like it.
CodesGuard stores source code and vulnerability data — the exact map of where your applications are weak. The controls that protect it are built in, not sold as an add-on.
Isolation by default
- Dynamic scans run in a per-workspace tenant — a private namespace with its own tooling, gateway and scanner.
- Workspaces are fully isolated: separate projects, engagements, findings, members and plan. Nothing crosses between them.
- SAST uses the shared engine and needs no tenant sandbox at all.
Nothing runs unauthorized
- Dynamic testing requires an attested engagement — you record that you're authorized to test the targets.
- Every target passes DNS ownership verification before a scan can touch it.
- AI Pentest bounds each run with a tool policy, blocks destructive actions, and stops after one proof.
Account security
- Authenticator-based two-factor authentication (TOTP) with one-time backup codes.
- Workspace roles, invitations and owner controls over members and settings.
- Single sign-on available on Enterprise.
Credentials & data
- Registry and session secrets are write-only — shown once, held on your own scanner, never echoed back or put in a report.
- Captured login sessions are used only to reach authenticated pages during a scan.
- Result retention and audit-log retention scale with your plan.
Measured, not asserted
- Detection is scored in CI against a planted-flaw application and a clean control.
- A regression in any vulnerability class fails the build before it can ship.
- Coverage distinguishes “never attacked” from “attacked and not found”, so a zero is honest.
Reproducible tooling
- Each tenant pins exact image versions of its scanner and tooling.
- Results are comparable over time and you always know what ran.
- Every scan that uses network access during a build says so in its report.
Your source code
What happens to the code you upload
We hold source code and the map of where it's weak, so here is exactly how it moves through the platform and how long we keep it.
How it gets in
You upload a .zip of your source, or push it from your pipeline through the API. No standing connection to your repositories is required.
How it's processed
Static analysis runs in the shared engine; dynamic scans run in your workspace's isolated tenant. A dependency build, when used, runs in a sandbox with no network access unless you explicitly allow it — and every scan that touches the network says so in its report.
How it's stored
Source and results live in your workspace's isolated storage, separate from every other workspace, and reached over encrypted (HTTPS) connections.
How long it's kept
Result and audit-log retention are set by your plan; when retention expires, data ages out. Custom retention and deletion are available on Enterprise.
Deployment, access & compliance
Controls for regulated teams
On-premises or cloud, single sign-on, role-based access, audit logging and two-factor authentication — the controls enterprise security teams ask for.
Deployment choices
Run on our multi-tenant cloud, a dedicated tenant stack, or on-premises where your team owns the infrastructure.
Single sign-on
SAML / OIDC single sign-on for your whole workspace, available on Enterprise.
Roles & access (RBAC)
Workspace roles, invitations and owner controls decide who can see and do what.
Audit log
An exportable record of workspace activity, with retention that scales by plan.
Two-factor authentication
Authenticator-based 2FA (TOTP) with one-time backup codes, for every account.
Compliance reviews
Isolation, 2FA, RBAC, audit logs and authorization attestation are built in. We'll work through your security questionnaire or compliance review.
Reporting a vulnerability
Found a security issue in CodesGuard itself? We want to hear about it. Email our security team and we'll acknowledge your report and keep you updated as we investigate.
[email protected]Compliance questionnaire or security review? Reach out via the contact page.
Security you can hand to your auditors
Talk to us about SSO, dedicated stacks, retention and your compliance questionnaire.