Code scanning concepts

Static analysis finds patterns in source code

Code scanning tools inspect source code for potential security issues, bugs and risky patterns without requiring the application to be running normally.

Integrate findings into pull requests

Security findings are most useful when developers receive feedback before changes reach production. CI checks can help prevent known classes of problems from being merged.

Understand false positives

Automated security analysis is not perfect. Teams should triage findings, document accepted risks and improve rules where practical.