Security and risk management#
The Security and risk management feature helps you quickly identify, track, and address security across your organization by automatically opening time-bound, prioritized findings whenever security problems are detected in your organization repositories, in your connected Jira instance, or as a result of penetration testing.
Under Security and risk management, you can find the following pages to help you monitor the security of your repositories:
Overview
The security posture of your organization: open findings by severity, scan type distribution, resolution history, and your highest-risk repositories.
Findings
Review and prioritize findings, inspect dependency chains and affected functions, and track the deadlines and statuses Codacy assigns them.
Dependencies
The dependencies used across your repositories, populated by daily SCA re-scans, with OSSF Scorecard data for each one.
App scanning
Dynamic Application Security Testing for web applications and APIs: create scan targets and run scans against running code.
Container scanning
Nightly scans of your container images, set up through your CI/CD pipeline or by uploading an SBOM manually.
In addition, on these pages, you can share filtered views of findings, export findings as a CSV file, and review severity rules and integration settings
Overview#
The Security and risk management overview page provides a high-level view of the security posture of your organization, including the number of open findings, the distribution of open findings by severity, the history of finding resolution, and a breakdown of the most high-risk repositories and most detected security categories.
Use this page to assess your organization's security posture and its progress over time, identify areas for improvement, and share findings with stakeholders.
To access the overview page, select an organization from the top navigation bar and select Security and risk on the left navigation sidebar.
The overview page includes six panels:
- Open findings overview
- Scan types distribution
- Open findings history
- Activity history
- Top 10 high-risk repositories
- Top 10 common security categories
To limit the information displayed in each panel, use the filter drop-down above the main area, and choose the relevant repositories, or utilise Segments.
Check out how to enable and configure Segments
Open findings overview#
The Open findings overview panel displays the total number of open security findings and the number of findings of each severity, helping you quickly assess the overall security posture of your organization and quickly review findings that are critical or overdue.
Within this same panel, an additional visualization shows the relative distribution of open findings by status, helping you evaluate the distribution of risk across different criteria and identify areas that may need immediate attention.
To access the findings page with the corresponding filter applied, click on a number or bar area.
Scan types distribution#
The Scan types panel shows the relative distribution of open findings by scan type. To access the findings page with the corresponding filter applied, click on a number from the panel.
Open findings history#
The Open findings history graph shows the open findings trends over the past three months, grouped by week and severity. It details the progression of your organization's risk and security posture over time and can, for example, help you understand if the right issues are being addressed.
For a detailed view of the distribution on a specific week, hover over the graph.
Activity history#
The Activity history graph shows weekly counts of open, closed, ignored and unignored findings over the past three months, overlaid on the overall open findings trend. It complements the Open findings history graph with more information, such as the volume of findings addressed each week and a visual representation of the new/closed ratio.
To filter the graph by finding severity, use the drop-down in the top right-hand corner of the panel.
For a detailed view of the counts on a specific week, hover over the graph.
Top 10 high-risk repositories#
The Top 10 high-risk repositories list shows the repositories with the highest number of open findings, ordered by severity.
Note
This panel may list fewer than ten repositories if there are fewer than ten repositories with open findings in the organization or if fewer than ten repositories are selected in the dropdown Repository filter.
Top 10 common security categories#
The Top 10 common security categories list shows the most common security categories of open findings, ordered by count.
To access the findings page with the corresponding filter applied, click on a category.
Supported security categories#
Note
Due to a recent update, some issues may be temporarily assigned the Not yet categorized category. To categorize these issues, you can reanalyze the default branch of the relevant repository. For a list of repositories that have issues with this category, use the Security category filter on the Findings page. Note that some issues just don't have a security category. These issues will remain Not yet categorized.
Each Codacy issue reported by Security and risk management belongs to one of the following security categories:
| Security category | Description |
|---|---|
| Android | Android-specific security issues. |
| Authentication | Broken authentication and authorization attacks consist in gaining access to accounts that allow disclosing sensitive information or performing operations that could compromise the system. |
| Command Injection | Command injection attacks aim to execute arbitrary commands on the host operating system. |
| Cookies | Security issues related to insecure cookies. |
| Cryptography | Cryptography attacks exploit failures related to cryptography (or lack thereof), potentially leading to exposure of sensitive data. |
| CSRF | Cross-Site Request Forgery (CSRF) attacks force an end user to execute unwanted actions on a web application in which they're currently authenticated. |
| Denial of Service | Denial of Service (DoS) attacks make a resource (site, application, server) unavailable for legitimate users, typically by flooding the resource with requests or exploiting a vulnerability to trigger a crash. |
| File Access | File access security issues may allow an attacker to access arbitrary files and directories stored on the file system such as application source code, configuration, and critical system files. |
| HTTP Headers | Insecure HTTP headers are a common attack vector for malicious users. |
| Input Validation | Client input should always be validated to prevent malformed or malicious data from entering the workflow of an information system. |
| Insecure Modules and Libraries | Security issues related to modules or libraries that are malicious or can potentially include vulnerabilities. |
| Insecure Storage | Security issues related to insecure storage of sensitive data. |
| Malicious Code | Security issues related to code patterns that are potentially unsafe. |
| Mass Assignment | Unprotected mass assignments are a Rails feature that could allow an attacker to update sensitive model attributes. |
| Regex | Regular expressions can be used in Denial of Service attacks, exploiting the fact that in most regular expression implementations the computational load grows exponentially with input size. |
| Routes | Badly configured routes can give unintended access to an attacker. |
| SQL Injection | SQL injection attacks insert or "inject" malicious SQL queries into the application via the client input data. |
| SSL | Security issues related with old SSL versions or configurations that have known cryptographic weaknesses and should no longer be used. |
| Unexpected Behaviour | Security issues related to potentially insecure system API calls. |
| Visibility | Logging should always be included for security events to better allow attack detection and help defend against vulnerabilities. |
| XSS | Cross-Site Scripting (XSS) attacks inject malicious client-side scripts into trusted websites that are visited by the end users. |
| Other | Other language-specific security issues. |
Scan types#
Security and risk management classifies each finding with a Scan type, indicating the specific source or method used to detect the finding. This information helps you understand the origin of the finding and the context in which the underlying issue was detected.
The following table lists the available scan types and their descriptions:
| Scan type | Description |
|---|---|
| Code Scanning | Analysis of source code for vulnerabilities without execution. Also known as Static Application Security Testing (SAST). |
| Software Composition Analysis | Analysis of external libraries and packages for malicious intent, vulnerabilities, or outdated versions. |
| Exposed Secrets | Detection of sensitive information, such as passwords or API keys, inadvertently included in the code. |
| Infrastructure as Code | Detection of configuration issues within infrastructure-as-code (IaC) files that could pose risks. |
| Penetration Testing | Results from penetration testing to find security vulnerabilities in running code. |
| App Scanning | Simulated attacks on live applications to find vulnerabilities. Also known as Dynamic Application Security Testing (DAST). |
Languages checked for security issues#
Security and risk management supports checking the languages and infrastructure-as-code platforms below for any Codacy security issues reported by the corresponding tools:
1: Currently, Trivy only supports scanning YAML files on this platform.
2: Supported as a client-side tool.
3: Includes the plugin Find Security Bugs.
4: Includes the plugins no-unsanitized, security, security-node, and xss.
Was this page helpful?
Your feedback helps us improve the documentation.
255 characters left
Thanks for helping improve Codacy documentation.
For more detailed feedback, open an issue on GitHub.