Rules find known patterns. The security audit looks for what rules miss: an AI model reads a project's most important code, and the code that changed since the last audit, looking for vulnerabilities. Only what an independent check confirms counts as a finding.
Switching it on
Security → Settings → Security audit has a switch and how often it runs: daily, weekly (the default) or monthly. Until you switch it, it follows your plan: on for paid plans, off on Free. You can switch it on for a Free organization or off for a paid one, for the organization default or for one project.
The audit reads the default branch of each project where it is on.
What a run does
- Choose files. Coroid ranks the project's source files and reads the most important first: code on the threat model's high-impact paths and entry points, with code changed since the last audit before code that did not change. A run reads at most 40 files.
- Look for vulnerabilities. For each file, the model looks for a fixed set of vulnerability kinds: SQL, command and other injection, cross-site scripting, cross-site request forgery, server-side request forgery, path traversal, open redirects, insecure deserialization, broken access control, broken authentication, hard-coded credentials, weak cryptography, information exposure and resource exhaustion. It must name the lines; an answer that points outside the code it was shown is dropped.
- Confirm. Each issue is recorded as Not confirmed yet. For critical and high issues, an independent check re-derives the issue from the code at that commit. If it does, the issue becomes a confirmed finding, with a validated static finding as its evidence. See Evidence.
- Look for variants. Flaws come in families. For each confirmed finding, Coroid searches the repository for the same pattern and checks each match the same way.
Findings from the audit show Security audit as their source in Security → Findings.
What it costs
The audit uses an AI model, so it spends your credits and agent hours like other work, and appears in Mission Control while it runs and in Settings → Activity with its cost.
Each run has a budget. When the run reaches it, or your credits or agent hours run out, it stops and keeps what it already confirmed; the next run starts again from the most important code. A large project's run continues across several jobs, so one run never holds an agent slot for long.
Fixing what it finds
Owners and admins choose Fix on a confirmed finding to file a fix task. See Fix pull requests. The audit does not open fix work by itself yet.
An audit finding is in your own code, so it is not public. On a public repository, or one whose visibility Coroid cannot confirm, its fix is held privately until an owner or admin publishes it. See Disclosure.
Proofs
Planned. Coroid will prove a candidate issue by running it against a disposable copy of your application in an isolated environment, with no network access, no credentials and no customer data, and turn the proof into a regression test. Until then, the audit's evidence is the independent check described above.
The Security audit report
New Work no longer offers a written Security audit report. It links to the audit's findings in Security instead.