An engineer unchecks 'public access' on a bucket in the console and closes the finding.
The next terraform apply recreates the bucket exactly as the template describes it, because the template was never changed. The finding returns, gets re-triaged, gets fixed in the console again. Everyone is busy and nothing improves — and meanwhile a dependency scan returns 400 findings sorted by CVSS, most of them in code paths the application never executes.
The risk of not knowing
If it is not surfaced today, it is exposed today. Attackers do not wait for your quarterly review — and neither do auditors.
The mechanism, not the marketing
- 1
Static analysis traces untrusted input to dangerous operations in application source, and dependency analysis inventories what you actually ship — including transitive packages — against known vulnerabilities.
- 2
IaC scanning evaluates Terraform, CloudFormation, Helm and Kubernetes manifests against the same policy set the runtime posture engine uses, so a template is judged before it creates anything.
- 3
Secret detection runs across source, image layers, pipeline configuration and committed state — the places copies accumulate, rather than only the secrets store where things are done correctly.
- 4
Findings are joined to the running estate on the same security graph, so a dependency finding carries whether the workload is internet-reachable and what identity it holds — the two facts that decide whether a CVSS score matters here.
- 5
Every runtime finding keeps its provenance: which repository, template and resource block produced it, so remediation lands in code and does not reappear on the next apply.
Specific outputs, measurable outcomes
Code Security in the real console.
Not a mockup — the actual Onam console on a live demo account, showing exactly what your team sees.
Questions we get a lot
Ready to see Code Security in your cloud?
Connect a read-only role in three minutes. Your first findings surface in under five.