CodeSecurity finds the vulnerabilities, leaked secrets, risky dependencies and AI-specific flaws in your codebase — from a single application process on one ordinary server. No Docker. No Kubernetes. No Elasticsearch. No data ever leaves your perimeter.
The tooling is excellent, and then you read the installation guide: a container orchestrator, a search cluster, a message broker and 16 GB of RAM before it inspects a single line. For a mid-sized engineering team, a consultancy, a bank on an isolated network or a defence contractor with no internet at all, that is not a trade-off — it is a wall. CodeSecurity was built by removing that wall.
| Requirement | CodeSecurity | Typical enterprise scanner |
|---|---|---|
| Installation | pip install, then run | Multi-service container stack |
| Memory in use | ~100 MB | 4–16 GB |
| Database | SQLite by default, PostgreSQL when you scale | PostgreSQL + Elasticsearch mandatory |
| Background jobs | Built in, hardware aware | Redis + Celery or RabbitMQ |
| Front-end build step | None | Webpack / Vite pipeline |
| Works with no internet | Yes, by design | Usually not |
| Where your source code goes | Nowhere. It stays on your server | Frequently a vendor cloud |
Every engine runs in the same pass and writes into one unified finding model, so you triage a single prioritised queue instead of reconciling six tools by hand.
Shannon-entropy analysis combined with provider-specific patterns for AWS keys, Stripe live keys, GitHub and Slack tokens, private certificates and database connection strings. Detected secrets are masked everywhere they appear.
Entropy + patternTrue abstract-syntax-tree analysis for Python, plus context-aware rules for JavaScript, TypeScript, Java, Go, PHP and Vue. Injection, unsafe deserialisation, path traversal, SSRF and weak cryptography, each mapped to a CWE.
AST + lexicalLockfile and manifest parsing across npm, PyPI, Maven, Go modules, Composer, RubyGems and Cargo, matched by semantic-version range against OSV, the NVD, GitHub advisories, CISA KEV and EPSS exploit-probability scores.
7 ecosystemsComplete coverage of the OWASP Top 10 for LLM Applications: prompt-injection surfaces, unsafe model output piped into execution sinks, unsafe model deserialisation, excessive agent permissions and vector-store tenant isolation.
LLM01–LLM10Hardening checks for Dockerfiles, Kubernetes manifests and GitHub Actions workflows — mutable base tags, privileged containers, host-path mounts, secrets in build arguments and over-broad workflow permissions.
Docker · K8s · ActionsEvery dependency classified as permissive, weak copyleft, strong copyleft or forbidden, with the contamination path shown — so an AGPL package never reaches your proprietary build unnoticed. Unparseable licences are flagged, never guessed.
Legal riskInter-procedural dataflow traces a value from source to sink, and call-graph analysis determines whether a vulnerable dependency function is actually invoked. Unreachable issues are down-ranked and labelled — never silently hidden.
Noise reductionDetects personal data in code, fixtures and log statements — card numbers, national identifiers, health data — and flags weak algorithms, hard-coded keys and non-cryptographic randomness, including a post-quantum readiness inventory.
GDPR · DPDP · HIPAA · PCIContainer and operating-system package analysis without a Docker daemon, typosquat and dependency-confusion detection, install-script inspection, and build-provenance verification against SLSA, in-toto and Sigstore.
ProvenanceMost tools only learn about a new CVE the next time somebody triggers a scan. CodeSecurity continuously synchronises with OSV, the National Vulnerability Database, MITRE CWE, the CISA Known Exploited Vulnerabilities catalogue and EPSS. When a new advisory lands, it is matched in-database against every component inventory you already hold.
“A critical vulnerability was announced this morning. Are we exposed?”
Without continuous matching, answering that means scheduling scans across every repository and waiting. With it, the answer is already on the dashboard — which repositories, which components, which versions, and how urgent based on whether the flaw is being exploited in the wild.
Defence, banking, healthcare and government environments cannot send source code to a vendor cloud, and often cannot reach one at all. Air-gapped operation is not an afterthought here — it is an architectural constraint the whole platform was built against. Export a signed intelligence bundle on a connected machine, carry it across on removable media, import it with signature verification.
A vulnerability report nobody opens is not a control. CodeSecurity pushes results into the developer’s existing workflow — the editor, the commit, the pull request and the pipeline — with a concrete fix attached rather than a lecture.
Every finding carries the full evidence chain: which repository, which branch, which commit, which file, which lines — what was found, which standard it was checked against, which control it breaches, how severe it is and why, and exactly how to fix it.
Posture score, letter grade, risk distribution and trend. Written for a board, not a build server.
Every finding with code excerpt, CWE, CVSS, exploit probability and a concrete remediation.
What this branch introduced, what was fixed, and what regressed since the baseline scan.
Control-by-control evidence, ready to hand to an assessor without manual assembly.
LDAP and Active Directory, SAML 2.0 and OIDC single sign-on, SCIM 2.0 user provisioning, time-based multi-factor authentication, and scoped API tokens with IP allow-listing across a five-tier role model.
Every policy change, triage decision and risk acceptance is written to an append-only log, each record cryptographically chained to the one before it, so removal or alteration is detectable.
Quality gates, remediation deadlines, licence policy and suppression rules live in a version-controlled file, reviewed through your normal pull-request process rather than clicked into a console.
Every suppression requires a written justification and an expiry date. When it expires the finding reopens automatically — accepted risk that quietly becomes permanent is how breaches accumulate.
Deadlines by severity with automatic escalation, and known-exploited vulnerabilities inheriting the shorter regulatory deadline where one applies.
Import SARIF from the scanners you already run and deduplicate them against native findings, so one queue and one report cover every tool in the estate.
CodeSecurity is dual-licensed. Self-host it inside your own organisation at no subscription cost under the GNU AGPL-3.0. Only need to pay one time setup fee. If you intend to redistribute it, offer it as a service, embed it in a product or remove its attribution, you need a commercial licence from Zhost Consulting Private Limited.
GNU AGPL-3.0
Zhost Commercial Licence
No. CodeSecurity is installed on your own server and analyses code locally. There is no vendor cloud, no telemetry and no licence phone-home. In air-gapped deployments the machine has no route to the internet at all, and the platform is designed to work normally in that state rather than merely tolerate it.
Python 3.10 or newer and Git. That is the whole list. A running instance uses roughly 100 MB of memory, so an ordinary virtual machine or even a developer laptop is sufficient. SQLite is used by default; switch to PostgreSQL by changing one connection string when you outgrow it.
Static analysis covers Python with full syntax-tree analysis, plus JavaScript, TypeScript, Java, Go, PHP and Vue with context-aware rules. Dependency analysis covers npm, PyPI, Maven, Go modules, Composer, RubyGems and Cargo. Infrastructure scanning covers Dockerfiles, Kubernetes manifests and GitHub Actions.
Secret detection, personal-data detection and cryptography checks are language-independent and apply to every text file in the repository. Broader language and infrastructure coverage is on the roadmap; we would rather tell you exactly what works today than have you discover the gap yourself.
Built-in scanners are good at dependency alerts for repositories hosted with that provider. CodeSecurity adds unified secret, static, infrastructure, privacy, cryptography and AI-specific analysis across every repository regardless of where it is hosted, runs entirely inside your perimeter, produces audit-grade compliance evidence, and can ingest your existing scanners’ SARIF output so everything is triaged in one queue.
That failure mode is treated as a design constraint rather than an afterthought. Reachability analysis determines whether a vulnerable dependency function is genuinely called and down-ranks it when it is not. Contextual risk scoring weighs severity, confidence, asset criticality and real-world exploit probability, and every score is explained in one sentence rather than being an opaque number.
Findings can be suppressed — but only with a written justification and an expiry date, so exceptions stay visible and accountable.
Yes. The command-line scanner returns a non-zero exit code when your quality gate is breached, which is all any pipeline needs. Thresholds are configurable by severity and category, and you can gate only on newly introduced findings so existing technical debt does not block every build while you work through it.
On a connected machine you export a threat-intelligence bundle. You carry it across on removable media and import it on the isolated instance, where its cryptographic signature is verified before anything is unpacked. Connected deployments simply synchronise automatically in the background.
Not for running it inside your own organisation to scan your own code — that is free under the AGPL-3.0, with no seat count and no repository limit.
You need a commercial licence if you intend to redistribute or resell it, operate it as a hosted service for third parties, embed it in another product, keep your modifications closed, or remove the attribution. If you are unsure which side of the line you fall on, ask us — it is usually a short conversation.
A working instance scanning its first repository is a matter of minutes, because there is no container stack to stand up. Production rollout — single sign-on, role mapping, quality-gate policy, pipeline integration and report templates — is typically a short engagement, and we can run it with you.
Commercial licence holders receive contracted response and resolution targets, extended version support, private security advisories, deployment assistance, custom detection-rule development and roadmap prioritisation. Community users have the public issue tracker and documentation.
We will walk you through a live scan of a repository you choose, show you the findings and the reports they produce, and answer the licensing question honestly — including when you do not need a commercial licence at all.
CodeSecurity finds the vulnerabilities, leaked secrets, risky dependencies and AI-specific flaws in your codebase — from a single application process on one ordinary server. No Docker. No Kubernetes. No Elasticsearch. No data ever leaves your perimeter.
The tooling is excellent, and then you read the installation guide: a container orchestrator, a search cluster, a message broker and 16 GB of RAM before it inspects a single line. For a mid-sized engineering team, a consultancy, a bank on an isolated network or a defence contractor with no internet at all, that is not a trade-off — it is a wall. CodeSecurity was built by removing that wall.
| Requirement | CodeSecurity | Typical enterprise scanner |
|---|---|---|
| Installation | pip install, then run | Multi-service container stack |
| Memory in use | ~100 MB | 4–16 GB |
| Database | SQLite by default, PostgreSQL when you scale | PostgreSQL + Elasticsearch mandatory |
| Background jobs | Built in, hardware aware | Redis + Celery or RabbitMQ |
| Front-end build step | None | Webpack / Vite pipeline |
| Works with no internet | Yes, by design | Usually not |
| Where your source code goes | Nowhere. It stays on your server | Frequently a vendor cloud |
Every engine runs in the same pass and writes into one unified finding model, so you triage a single prioritised queue instead of reconciling six tools by hand.
Shannon-entropy analysis combined with provider-specific patterns for AWS keys, Stripe live keys, GitHub and Slack tokens, private certificates and database connection strings. Detected secrets are masked everywhere they appear.
Entropy + patternTrue abstract-syntax-tree analysis for Python, plus context-aware rules for JavaScript, TypeScript, Java, Go, PHP and Vue. Injection, unsafe deserialisation, path traversal, SSRF and weak cryptography, each mapped to a CWE.
AST + lexicalLockfile and manifest parsing across npm, PyPI, Maven, Go modules, Composer, RubyGems and Cargo, matched by semantic-version range against OSV, the NVD, GitHub advisories, CISA KEV and EPSS exploit-probability scores.
7 ecosystemsComplete coverage of the OWASP Top 10 for LLM Applications: prompt-injection surfaces, unsafe model output piped into execution sinks, unsafe model deserialisation, excessive agent permissions and vector-store tenant isolation.
LLM01–LLM10Hardening checks for Dockerfiles, Kubernetes manifests and GitHub Actions workflows — mutable base tags, privileged containers, host-path mounts, secrets in build arguments and over-broad workflow permissions.
Docker · K8s · ActionsEvery dependency classified as permissive, weak copyleft, strong copyleft or forbidden, with the contamination path shown — so an AGPL package never reaches your proprietary build unnoticed. Unparseable licences are flagged, never guessed.
Legal riskInter-procedural dataflow traces a value from source to sink, and call-graph analysis determines whether a vulnerable dependency function is actually invoked. Unreachable issues are down-ranked and labelled — never silently hidden.
Noise reductionDetects personal data in code, fixtures and log statements — card numbers, national identifiers, health data — and flags weak algorithms, hard-coded keys and non-cryptographic randomness, including a post-quantum readiness inventory.
GDPR · DPDP · HIPAA · PCIContainer and operating-system package analysis without a Docker daemon, typosquat and dependency-confusion detection, install-script inspection, and build-provenance verification against SLSA, in-toto and Sigstore.
ProvenanceMost tools only learn about a new CVE the next time somebody triggers a scan. CodeSecurity continuously synchronises with OSV, the National Vulnerability Database, MITRE CWE, the CISA Known Exploited Vulnerabilities catalogue and EPSS. When a new advisory lands, it is matched in-database against every component inventory you already hold.
“A critical vulnerability was announced this morning. Are we exposed?”
Without continuous matching, answering that means scheduling scans across every repository and waiting. With it, the answer is already on the dashboard — which repositories, which components, which versions, and how urgent based on whether the flaw is being exploited in the wild.
Defence, banking, healthcare and government environments cannot send source code to a vendor cloud, and often cannot reach one at all. Air-gapped operation is not an afterthought here — it is an architectural constraint the whole platform was built against. Export a signed intelligence bundle on a connected machine, carry it across on removable media, import it with signature verification.
A vulnerability report nobody opens is not a control. CodeSecurity pushes results into the developer’s existing workflow — the editor, the commit, the pull request and the pipeline — with a concrete fix attached rather than a lecture.
Every finding carries the full evidence chain: which repository, which branch, which commit, which file, which lines — what was found, which standard it was checked against, which control it breaches, how severe it is and why, and exactly how to fix it.
Posture score, letter grade, risk distribution and trend. Written for a board, not a build server.
Every finding with code excerpt, CWE, CVSS, exploit probability and a concrete remediation.
What this branch introduced, what was fixed, and what regressed since the baseline scan.
Control-by-control evidence, ready to hand to an assessor without manual assembly.
LDAP and Active Directory, SAML 2.0 and OIDC single sign-on, SCIM 2.0 user provisioning, time-based multi-factor authentication, and scoped API tokens with IP allow-listing across a five-tier role model.
Every policy change, triage decision and risk acceptance is written to an append-only log, each record cryptographically chained to the one before it, so removal or alteration is detectable.
Quality gates, remediation deadlines, licence policy and suppression rules live in a version-controlled file, reviewed through your normal pull-request process rather than clicked into a console.
Every suppression requires a written justification and an expiry date. When it expires the finding reopens automatically — accepted risk that quietly becomes permanent is how breaches accumulate.
Deadlines by severity with automatic escalation, and known-exploited vulnerabilities inheriting the shorter regulatory deadline where one applies.
Import SARIF from the scanners you already run and deduplicate them against native findings, so one queue and one report cover every tool in the estate.
CodeSecurity is dual-licensed. Self-host it inside your own organisation at no subscription cost under the GNU AGPL-3.0. Only need to pay one time setup fee. If you intend to redistribute it, offer it as a service, embed it in a product or remove its attribution, you need a commercial licence from Zhost Consulting Private Limited.
GNU AGPL-3.0
Zhost Commercial Licence
No. CodeSecurity is installed on your own server and analyses code locally. There is no vendor cloud, no telemetry and no licence phone-home. In air-gapped deployments the machine has no route to the internet at all, and the platform is designed to work normally in that state rather than merely tolerate it.
Python 3.10 or newer and Git. That is the whole list. A running instance uses roughly 100 MB of memory, so an ordinary virtual machine or even a developer laptop is sufficient. SQLite is used by default; switch to PostgreSQL by changing one connection string when you outgrow it.
Static analysis covers Python with full syntax-tree analysis, plus JavaScript, TypeScript, Java, Go, PHP and Vue with context-aware rules. Dependency analysis covers npm, PyPI, Maven, Go modules, Composer, RubyGems and Cargo. Infrastructure scanning covers Dockerfiles, Kubernetes manifests and GitHub Actions.
Secret detection, personal-data detection and cryptography checks are language-independent and apply to every text file in the repository. Broader language and infrastructure coverage is on the roadmap; we would rather tell you exactly what works today than have you discover the gap yourself.
Built-in scanners are good at dependency alerts for repositories hosted with that provider. CodeSecurity adds unified secret, static, infrastructure, privacy, cryptography and AI-specific analysis across every repository regardless of where it is hosted, runs entirely inside your perimeter, produces audit-grade compliance evidence, and can ingest your existing scanners’ SARIF output so everything is triaged in one queue.
That failure mode is treated as a design constraint rather than an afterthought. Reachability analysis determines whether a vulnerable dependency function is genuinely called and down-ranks it when it is not. Contextual risk scoring weighs severity, confidence, asset criticality and real-world exploit probability, and every score is explained in one sentence rather than being an opaque number.
Findings can be suppressed — but only with a written justification and an expiry date, so exceptions stay visible and accountable.
Yes. The command-line scanner returns a non-zero exit code when your quality gate is breached, which is all any pipeline needs. Thresholds are configurable by severity and category, and you can gate only on newly introduced findings so existing technical debt does not block every build while you work through it.
On a connected machine you export a threat-intelligence bundle. You carry it across on removable media and import it on the isolated instance, where its cryptographic signature is verified before anything is unpacked. Connected deployments simply synchronise automatically in the background.
Not for running it inside your own organisation to scan your own code — that is free under the AGPL-3.0, with no seat count and no repository limit.
You need a commercial licence if you intend to redistribute or resell it, operate it as a hosted service for third parties, embed it in another product, keep your modifications closed, or remove the attribution. If you are unsure which side of the line you fall on, ask us — it is usually a short conversation.
A working instance scanning its first repository is a matter of minutes, because there is no container stack to stand up. Production rollout — single sign-on, role mapping, quality-gate policy, pipeline integration and report templates — is typically a short engagement, and we can run it with you.
Commercial licence holders receive contracted response and resolution targets, extended version support, private security advisories, deployment assistance, custom detection-rule development and roadmap prioritisation. Community users have the public issue tracker and documentation.
We will walk you through a live scan of a repository you choose, show you the findings and the reports they produce, and answer the licensing question honestly — including when you do not need a commercial licence at all.
We use cookies to provide you a better user experience on this website.Cookie Policy