SecOps — code and application security
SecOps is the engine behind Onam Code Security. It runs static analysis, secret detection, IaC checks, dependency and SBOM analysis, and dynamic testing, and reports them in the Code Security area of the console.
The full documentation now lives in the Code Security section:
| Topic | Page |
|---|---|
| What it does and how it fits with the rest of Onam | Overview |
| Static analysis — Python, JavaScript, TypeScript, Java, C#, Go, C, C++ and Ruby | SAST |
| Hard-coded credentials and keys | Secret detection |
| Terraform, Kubernetes YAML, CloudFormation and Dockerfiles | IaC checks |
| Dependencies, risk scoring, CycloneDX SBOM, VEX and NTIA | SCA and SBOM |
| Testing a running app or API | DAST |
| Corrected files on a fix branch | AI Code Fix |
| Calling scans from a pipeline | CI usage |
In one paragraph
Static analysis runs community security packs, Onam-curated taint rules and Onam-reviewed pattern rules, and keeps proven security issues apart from hotspots to review, which are capped at medium. Dependency analysis parses manifests and lockfiles natively, matches OSV and NVD advisories, and scores each one 0–10 from CVSS, EPSS, CISA KEV and fix availability. Dynamic testing discovers and attacks the endpoints of a running app you are authorised to test. AI Code Fix rewrites files flagged by static analysis onto a separate branch; nothing merges itself. There is no CI plugin today — pipelines call the API.
