Security watches your repositories for known-vulnerable dependencies, leaked credentials and vulnerable code, keeps everything it finds in one list, and turns what it confirms into pull requests that your team reviews and merges.
This section describes the product feature: your code's security. For how Coroid itself protects your code and data, see Security and deployment.
What it does
| Protection | What it does | Can fail a check |
|---|---|---|
| Vulnerable dependencies | Reads each project's lockfiles at the head of the default branch and matches every package against published advisories. Scans each pull request's lockfile changes the same way. | Yes |
| Fix vulnerable dependencies | Opens a pull request that upgrades a vulnerable package, critical findings first. | No |
| Leaked secrets | Looks for credentials in every change, and once through the default branch's whole history. | Yes |
| Code scanning | Coroid's security rules for code, plus your own scan command if you have one. | Yes |
| Security review on pull requests | Checks the security issues Coroid Review raises, with an independent check, before any of them can fail a pull request. | Yes |
| GitHub security alerts | Imports Dependabot, code scanning and secret scanning alerts so they sit next to Coroid's own findings. | No |
| Security audit | Reads your most important code, and the code that changed since the last audit, looking for vulnerabilities. Keeps only what an independent check confirms. | No |
Each protection is explained in its own page in this section. See Protections and enforcement for how they are switched on, observed and enforced.
Where it lives
Security has its own place in the main menu, after Quality Control:
- Overview: open findings by severity and how many are past their due date, each project's coverage and last scan, fix progress, the state of the advisory data and of GitHub's alerts.
- Findings: the one list of everything Security found, grouped by project. See Findings and their lifecycle.
- Dependencies: each project's package inventory, with an export in CycloneDX format. See Vulnerable dependencies.
- Threat models: one per project. See Threat models.
- Settings: the organization default and each project, with a switch per protection.
Every member sees Overview, Findings, Dependencies and Threat models for the projects they can see. Organization owners and admins change settings, threat models and exceptions, and act on findings. Fix tasks are ordinary work: they appear in Factory, and a finding links to its task and pull request.
How it decides
Evidence decides. A finding blocks a pull request or notifies anyone only with evidence of a named type, verified at a specific commit. Anything else is listed as "Not confirmed yet" and does nothing else. See Evidence.
No silent green. A clean result counts only from a complete scan. A partial scan, a lost permission, an old inventory or delayed advisory data shows as unknown or partial coverage, never as fixed.
People stay in control. Coroid opens pull requests; people merge them. Exceptions, scanner configuration and disclosure are decided in Security by owners and admins, never by a change under test.
Private by default. Details of a vulnerability that is not public yet stay inside Coroid until someone with the authority discloses it. See Disclosure.
Coroid never uses a credential it finds. It does not try a leaked credential to see whether it works.
What it costs
Security is on every plan, Free included.
- Detection costs nothing. Inventories, advisory matching, secret and code scans and alert imports use no AI model, so they spend neither credits nor agent hours. Each organization's own scans take one of its agent slots while they run. When none is free they wait, shown as waiting in Mission Control, and coverage reads unknown until they run. Pausing agent work in Mission Control does not pause security scans.
- Work that uses a model is charged like any other work: fix tasks, the security audit, and the independent check of Coroid Review's security claims. It spends your credits and agent hours, appears in Settings → Activity, and waits when credits or hours run out. Detection keeps running.
What it does not cover yet
Container images, infrastructure as code, runtime scanning and licences are not covered. CI workflow configuration is covered only by Coroid's existing code rules. Overview says so, so nothing reads as covered that is not.