The first scan of a mature repository returns a wall of findings, and most of them are pattern matches nobody can act on without reading the code.
The one real injection flaw is in there somewhere, ranked next to a hundred hotspots with the same severity. The dependency report is no better: sorted by CVSS, it puts a theoretical 9.8 above a medium-rated bug that attackers are exploiting this week. The team triages for a day, fixes nothing important, and stops opening the report.
The cost of a noisy scanner
When every pattern match is reported as an alert, the real injection flaw sits on page four. Teams stop reading the report, and the scanner becomes a compliance checkbox instead of a control.
Code Security in two minutes
Voices are AI-generated. More short Q&A videos: Onam Security: cloud security
The mechanism, not the marketing
- 1
You give Onam a repository's HTTPS address and a branch — GitHub, GitLab or Bitbucket — and, if you want dynamic testing, the URL of a running app you are authorised to test. Each scan runs as its own isolated job against a shallow clone of that branch, and the clone is deleted when the scan ends.
- 2
Static analysis runs on the open-source Semgrep engine with three rule sources: community security packs (OWASP Top 10, security audit, secrets, Node.js), Onam-curated taint rules that follow untrusted input to a dangerous call, and Onam-reviewed pattern rules. Pattern rules that were judged code-quality rather than security are dropped before a scan runs.
- 3
Every result is graded by how much the rule can prove. Taint and AST matches become Security issues and keep the severity the rule asserts; pattern matches become Hotspots to review, capped at medium, so they can never outrank a confirmed flaw. Each finding carries the file, line, rule, CWE and OWASP category.
- 4
Dependency analysis reads manifests and lockfiles itself, matches each component against OSV and NVD advisories, adds EPSS exploit probability and CISA KEV membership, and turns them into a single 0–10 risk score. The same pass produces a CycloneDX 1.5 SBOM for the repository.
- 5
IaC templates and Dockerfiles in the same clone are checked in the same scan, and secret rules run over every file. If you gave a target URL, dynamic testing discovers the app's endpoints and sends rate-limited test payloads at them.
- 6
Results land in the Code Security console — projects, alerts, scan history, per-scanner tabs and trend reports — and static and dynamic scan results also feed the AppSec pillar of the platform's CNAPP posture score, next to your cloud posture.
Specific outputs, measurable outcomes
One scan, five scanners, one place to read the result
Static analysis, dependency analysis and IaC checks run together on every repository scan. Dynamic testing joins in when you give it a URL. Fixes come back as a branch, never as a merge.
Pick a scanner to see how it really works
Community packs, curated taint rules and reviewed pattern rules. Proven flaws and hotspots in separate lists.
How SAST worksCloud keys, private keys, SaaS tokens and hard-coded credentials, found in the same pass as SAST.
Secrets on the SAST pageLockfiles parsed natively, OSV and NVD matching, EPSS and KEV risk scoring, CycloneDX 1.5 SBOM.
How SCA worksTerraform, Kubernetes YAML, CloudFormation and Dockerfiles in the repository are checked in the same scan.
IaC in the docsEndpoint discovery and rate-limited test payloads against a running app or API you are authorised to test.
How DAST worksCorrected source files on a separate branch for your review. Nothing merges or deploys itself.
How AI Code Fix worksThe proven findings come first
A scan result opens on four numbers — total findings, security issues, hotspots to review and the languages found — then the security issues table, with file and line for each. Hotspots have their own panel. Every finding opens to the rule's guidance and an AI fix prompt you can copy.
Around it: a projects view with a risk score per repository, an alerts list across SAST, DAST and SCA, scan history, and trend reports you can export as CSV or PDF.
What is joined today, and what is not yet
Code security lives in the same platform as Onam's cloud posture, identity and data engines. Here is exactly how far that connection goes today.
- Code findings sit in the same platform, under the same login and roles, as your cloud findings
- SAST and DAST results feed the AppSec pillar of the CNAPP posture score
- Dependency advisories come from the same OSV and NVD store the vulnerability engine uses
- Static-analysis findings also appear in the platform-wide findings store, tagged as code
- Linking a code finding to the container image or workload built from that repository
- Reachability — whether the vulnerable function in a dependency is actually called
- Tracing a runtime misconfiguration back to the template line that created it
Full detail is in the Code Security documentation.
Code security on one page
Inputs, how it works, what you get and the limits — the same sheet our team uses in briefings.
Open full sizeQuestions we get a lot
Ready to see Code Security on your code?
Point us at a repository and a test URL. We will run the scan with you and walk your team through what it found.