Skip to content
CodesGuard
NewSAST · SCA · DAST · IAST · AI Pentest

Application security that proves what it finds.

CodesGuard runs static, dependency, dynamic and autonomous AI testing against one workspace — and correlates everything into a single findings queue where every result carries its evidence.

Contact salesExplore the platform
Cloud or on-premisesFirst scan in minutesEvidence on every finding
app.codesguard.io/dashboard
OverviewDashboard
Search projects, findings, CVEs…⌘K
Environment online

Acme Corp · Production workspace

Good morning, Dana

New scan

Risk posture

214open findings

8.2% vs last 30 days

6Critical13High41Medium78Low76Info

19

Urgent

61

Fixed 30d

Findings over time

Discovered per week · last 8 weeks

Critical + HighBelow

Attention required

Highest-severity issues first

19 open

SQL query built from unsanitized request input

SAST · payments-api · query.go:142

Critical

RCE via log4j-core 2.14.1

SCA · identity-service · CVE-2021-44228

Critical

IDOR on invoice export — cross-tenant read

AI Pentest · Q3 web assessment

High

Reflected XSS in search parameter

DAST · shop.acme.example · /search

High

Every finding is chased from first signal to proof

Reconnaissance
Discovery
Analysis
Exploitation
Proof

Five modules, one workspace

Every question a security team asks, answered in one place

Each module stands on its own. Together they cover your code, your dependencies, your running apps and everything in between.

Static analysis

SAST

“Is there a vulnerability in the code we wrote?”

  • Taint tracing across files and functions
  • FP % score with the reasoning shown
  • Pass / fail gate per project
Explore SAST

Software composition

SCA

“Is there a known vulnerability in code we imported?”

  • Derived from SAST — no extra scan
  • GHSA and CVE advisories with the fixed versions they publish
  • Provenance back to the exact scan and finding
Explore SCA

Dynamic scanning

DAST

“Can it be exploited while it's running?”

  • Baseline, quick-active and full-active depths
  • Authenticated scanning via Interactive login
  • Request / response evidence per finding
Explore DAST

Interactive testing

IAST

Early access

“What is actually vulnerable under real traffic?”

  • In-process agent, JVM first
  • Exact request, code path and stack trace
  • Very low false positives
Explore IAST

Autonomous testing

AI Pentest

“What would a real attacker actually be able to do here?”

  • Recon → discovery → analysis → exploitation
  • Live reasoning and tool-call stream
  • Proof attached to every finding
Explore AI Pentest

See how they fit together

Engagements, isolated environments and the unified findings queue that ties the modules into one workflow.

Platform overview

Proof over noise

Three ways to prove the same class of bug

An injection flaw seen in the source, confirmed against the running app, then chained into a real exploit. Same platform, three kinds of evidence.

CriticalSQL injectionCWE-89 · A03:2021FP 25% · Likely real

payments-api · internal/ledger/query.go

138func (h *LedgerHandler) Query(w http.ResponseWriter, r *http.Request) {
139 email := r.URL.Query().Get("email")
140 sql := "SELECT * FROM ledger WHERE email = '" + email + "'"
141 
142 rows, err := h.db.Query(sql)
143 if err != nil { http.Error(w, err.Error(), 500); return }
r.URL.Query()emailh.db.Query(sql)

AI review

Tainted email is concatenated into the query with no parameterization or escaping. The path from request to sink is reachable unauthenticated. Fix: use a parameterized query with $1 binding.

HighReflected XSS in search parameterCWE-79 Confirmed · 3 of 3
Attack requestsent by the scanner

GET /search?q=<svg/onload=confirm(1)> HTTP/1.1

Host: shop.acme.example

Cookie: session=eyJhbGciOi… (replayed session)

Response200 OK · 41.2 KB · 184 ms

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

<h2>No results for <svg/onload=confirm(1)></h2>

The payload is returned unencoded in the page body — the element parses and executes. Differential oracle confirmed it on 3 of 3 attempts.

HighIDOR on invoice export — cross-tenant read Proven · 4 steps

Attack chain

  1. ReconRoute echoes a tenant id the client never sends

    httpx · jsluice

  2. DiscoveryExport endpoint absent from the OpenAPI spec

    ffuf

  3. AnalysisInvoice ids increment by one per tenant

    inference

  4. ExploitRequested a neighbouring id — got another tenant's PDF

    curl
Proof requestsession = tenant 8812

GET /api/invoices/44190/export HTTP/1.1

Authorization: Bearer eyJ…tenant_id=8812

Proof response200 OK · application/pdf

HTTP/1.1 200 OK

Bill to: Northwind Trading Ltd (tenant 9014)

Amount: 18,420.00 EUR

Correlated coverage

Four tools would show you four problems. CodesGuard shows you one.

The same weakness, seen from every angle, is deduplicated and prioritized into a single issue — so you fix what matters first instead of triaging the same bug three times.

How correlation works

  1. SAST flags the risky code path on push

    01

  2. DAST confirms it's reachable and exploitable at runtime

    02

  3. AI Pentest chains it into a full exploit with proof

    03

  4. Findings one correlated, prioritized issue in your queue

    04

One queue

A single, filterable list of everything that's wrong

A severity breakdown, a by-source split and one deduplicated queue. Work it top to bottom, or jump straight to the criticals from any module.

AllCriticalHighMedium
Deduplicated across modules
  • Critical

    SQL query built from unsanitized input

    payments-api · query.go:142

  • Critical

    Remote code execution via a vulnerable dependency

    identity-service

  • High

    IDOR on invoice export — cross-tenant read

    GET /api/invoices/{id}/export

  • High

    Reflected XSS in search parameter

    shop.acme.example · /search

  • Medium

    SQL injection confirmed on refund lookup

    POST /v1/refunds

Showing 5 of 164Every row links back to the scan that proved it
Filter by severity and source togetherEvery row links back to the scan that proved itThe dashboard shows trends; Findings is the worklist

Why CodesGuard

Built for teams that ship fast and refuse to guess

The things that make security tooling actually usable: proof, correlation, honesty about what was tested, and speed.

One platform, one data model

Static, dependency, dynamic, runtime and autonomous testing share one workspace, one severity scale and one queue.

Proof, not alerts

Every finding ships with reproducible evidence — a dataflow trace, a request/response pair, or a chained exploit.

Correlated across surfaces

A weakness in code, confirmed at runtime and exploited by an agent is one issue — deduplicated and prioritized.

Measured, not asserted

Detection is scored in CI against planted flaws and a clean control. A regression fails the build.

Safe by construction

Dynamic testing runs only against DNS-verified targets in attested engagements, inside per-workspace isolation.

Built for the pipeline

A pass/fail gate per project, findings you can wire into CI, and quotas that meter in real time.

Questions

The short version

More detail lives in the platform overview, or talk to sales.

How is CodesGuard different from a bundle of separate scanners?

The modules share one workspace and one findings queue. A weakness found in code, confirmed at runtime and exploited by an agent becomes a single correlated issue, not three duplicates in three tools.

What does “evidence-backed” actually mean?

Every finding carries reproducible proof. SAST shows the dataflow trace and highlighted sink; DAST shows the attack request and the response that proves it; AI Pentest shows the chain of steps and a reproduction command.

Which languages and targets are supported?

Static analysis covers JavaScript, TypeScript, PHP and Java with framework models for Express, NestJS, Next.js, Laravel, Symfony and Spring. Dynamic testing works against any HTTP application or API, including SPAs and authenticated sessions.

How do we get started?

Talk to our team and we'll set up a workspace and a walkthrough tailored to your stack. Every module — SAST, SCA, DAST, IAST and AI Pentest — runs against one workspace, with SSO and a dedicated stack available on Enterprise.

Ship software you can prove is secure.

See the platform on your own code, or talk to us about a dedicated Enterprise stack.

Contact salesExplore the platform