Security and risk management#
The Security and risk management feature helps you quickly identify, track, and address security across your organization by automatically opening time-bound, prioritized findings whenever security problems are detected in your organization repositories, in your connected Jira instance, or as a result of penetration testing.
Under Security and risk management, you can find the following pages to help you monitor the security of your repositories:
Reports
The security posture of your organization, and how fast your team fixes findings against your SLAs.
Findings
Review and prioritize findings, inspect dependency chains and affected functions, and track the deadlines and statuses Codacy assigns them.
Dependencies
The dependencies used across your repositories, populated by daily SCA re-scans, with OSSF Scorecard data for each one.
App scanning
Dynamic Application Security Testing for web applications and APIs: create scan targets and run scans against running code.
Container scanning
Nightly scans of your container images, set up through your CI/CD pipeline or by uploading an SBOM manually.
In addition, on these pages, you can share filtered views of findings, export findings as a CSV file, and review severity rules and integration settings
Reports#
The Reports tab shows the security posture of your organization and how fast your team fixes findings. It has two reports, documented on the Reports page:
- Overview: open findings by severity, scan type distribution, resolution history, and your highest-risk repositories.
- Remediation: mean time to remediate against your SLAs, the share of findings closed on time, and the overdue backlog, by severity.
Supported security categories#
Note
Due to a recent update, some issues may be temporarily assigned the Not yet categorized category. To categorize these issues, you can reanalyze the default branch of the relevant repository. For a list of repositories that have issues with this category, use the Security category filter on the Findings page. Note that some issues just don't have a security category. These issues will remain Not yet categorized.
Each Codacy issue reported by Security and risk management belongs to one of the following security categories:
| Security category | Description |
|---|---|
| Android | Android-specific security issues. |
| Authentication | Broken authentication and authorization attacks consist in gaining access to accounts that allow disclosing sensitive information or performing operations that could compromise the system. |
| Command Injection | Command injection attacks aim to execute arbitrary commands on the host operating system. |
| Cookies | Security issues related to insecure cookies. |
| Cryptography | Cryptography attacks exploit failures related to cryptography (or lack thereof), potentially leading to exposure of sensitive data. |
| CSRF | Cross-Site Request Forgery (CSRF) attacks force an end user to execute unwanted actions on a web application in which they're currently authenticated. |
| Denial of Service | Denial of Service (DoS) attacks make a resource (site, application, server) unavailable for legitimate users, typically by flooding the resource with requests or exploiting a vulnerability to trigger a crash. |
| File Access | File access security issues may allow an attacker to access arbitrary files and directories stored on the file system such as application source code, configuration, and critical system files. |
| HTTP Headers | Insecure HTTP headers are a common attack vector for malicious users. |
| Input Validation | Client input should always be validated to prevent malformed or malicious data from entering the workflow of an information system. |
| Insecure Modules and Libraries | Security issues related to modules or libraries that are malicious or can potentially include vulnerabilities. |
| Insecure Storage | Security issues related to insecure storage of sensitive data. |
| Malicious Code | Security issues related to code patterns that are potentially unsafe. |
| Mass Assignment | Unprotected mass assignments are a Rails feature that could allow an attacker to update sensitive model attributes. |
| Regex | Regular expressions can be used in Denial of Service attacks, exploiting the fact that in most regular expression implementations the computational load grows exponentially with input size. |
| Routes | Badly configured routes can give unintended access to an attacker. |
| SQL Injection | SQL injection attacks insert or "inject" malicious SQL queries into the application via the client input data. |
| SSL | Security issues related with old SSL versions or configurations that have known cryptographic weaknesses and should no longer be used. |
| Unexpected Behaviour | Security issues related to potentially insecure system API calls. |
| Visibility | Logging should always be included for security events to better allow attack detection and help defend against vulnerabilities. |
| XSS | Cross-Site Scripting (XSS) attacks inject malicious client-side scripts into trusted websites that are visited by the end users. |
| Other | Other language-specific security issues. |
Scan types#
Security and risk management classifies each finding with a Scan type, indicating the specific source or method used to detect the finding. This information helps you understand the origin of the finding and the context in which the underlying issue was detected.
The following table lists the available scan types and their descriptions:
| Scan type | Description |
|---|---|
| Code Scanning | Analysis of source code for vulnerabilities without execution. Also known as Static Application Security Testing (SAST). |
| Software Composition Analysis | Analysis of external libraries and packages for malicious intent, vulnerabilities, or outdated versions. |
| Exposed Secrets | Detection of sensitive information, such as passwords or API keys, inadvertently included in the code. |
| Infrastructure as Code | Detection of configuration issues within infrastructure-as-code (IaC) files that could pose risks. |
| Penetration Testing | Results from penetration testing to find security vulnerabilities in running code. |
| App Scanning | Simulated attacks on live applications to find vulnerabilities. Also known as Dynamic Application Security Testing (DAST). |
Languages checked for security issues#
Security and risk management supports checking the languages and infrastructure-as-code platforms below for any Codacy security issues reported by the corresponding tools:
1: Currently, Trivy only supports scanning YAML files on this platform.
2: Supported as a client-side tool.
3: Includes the plugin Find Security Bugs.
4: Includes the plugins no-unsanitized, security, security-node, and xss.
Was this page helpful?
Your feedback helps us improve the documentation.
255 characters left
Thanks for helping improve Codacy documentation.
For more detailed feedback, open an issue on GitHub.