Security Scan

Qoder CLI includes built-in security scanning to help identify high-risk issues while code is generated and changed. It adds a continuous security check to everyday development, helping you catch dangerous function calls, injection risks, sensitive data leaks, and data-flow issues earlier. Security scanning is not a replacement for a full security audit. Interactive scans focus on code generated in the current task and incremental changes. Repository scans can check the whole repository or selected paths and provide a deterministic security gate for CI/CD.

Entry Point

In the interactive TUI, run:

/security-settings

This opens the security scan settings panel. You can view and toggle each scan level from this panel. Security scanning is enabled by default. Settings are saved to your user configuration and control which scan levels are active. L1 Static Check is free; L2 Lightweight Scan and L3 Deep Scan may consume Credits, depending on in-product prompts and your account's billing rules.

Scan Levels

Qoder CLI divides security scanning into three levels. You can enable or disable each level independently.

L1 Static Check

L1 applies to code generated in the current task. It uses high-risk pattern matching to quickly catch common issues such as dangerous function calls, obvious sensitive data leak patterns, and other risks that often appear in generated code. L1 Static Check is a free baseline check. We recommend keeping it enabled by default so Qoder can quickly catch high-risk code patterns during the current task.

L2 Lightweight Scan

L2 applies to incremental code changes. It understands code semantics more deeply to identify risks such as SQL injection, remote command execution, and sensitive data leaks. Enable L2 when you want deeper security feedback during everyday coding.

L3 Deep Scan

L3 performs deeper analysis on incremental code changes. It traces data flows across files and functions to uncover hidden vulnerabilities that may not be visible from a single-file view. L3 is best used after commits are ready and before review, push, PR, release, or deployment handoff. If only working-tree changes exist, it may fall back to L2.

Configure Scan Levels

After opening /security-settings, use the arrow keys to move between scan levels, and press Enter or Space to toggle a level. Press q or Esc to close the panel. Each item in the panel shows its current state:

on means the level is enabled.
off means the level is disabled.
default means the default value is being used.
saved means the value has been written to user settings.

The settings panel writes only to user-level settings. It does not modify project-level settings.

Use the Settings File

You can also configure security scanning in your user-level settings.json. The settings live under securityScan:

{
  "securityScan": {
    "l1StaticCheck": true,
    "l2LightweightScan": true,
    "l3DeepScan": true
  }
}

All three options default to true. To disable a level, set the corresponding field to false:

{
  "securityScan": {
    "l1StaticCheck": true,
    "l2LightweightScan": false,
    "l3DeepScan": false
  }
}

How Automatic Scanning Works

When security scanning is enabled, Qoder CLI loads the built-in security capability according to your configuration and decides which checks to activate. When L1 is enabled, Qoder CLI triggers static checks after relevant tool calls. When L1 is disabled, this automatic check is not loaded. As long as at least one of L1, L2, or L3 is enabled, Qoder CLI keeps the unified security scan capability available. If all three levels are disabled, security scan capabilities are not loaded.

Manual Security Scan

In addition to automatic scan settings, Qoder CLI provides a manual security scan Skill:

/security-scan

The command routes security intent to one of three workflows:

Project/file scan: scans the whole repository or exact files and directories that you specify.
L2 lightweight review: reviews current working-tree changes.
L3 deep review: reviews unreviewed committed changes before push, PR, release, deployment, or other handoff workflows.

A bare /security-scan opens a picker with L3 deep scan, L2 lightweight scan, and Project/file scan. If you select Project/file scan without a scope, Qoder CLI asks whether to scan the whole repository or specific files and directories. You can also include the mode or scope directly:

/security-scan L2 lightweight review
/security-scan L3 deep review
/security-scan scan the whole repository
/security-scan scan src/auth and src/export

Project/file scans are available when any security scan level is enabled. L2 and L3 follow their own settings switches. If an explicit L2 or L3 request is disabled, Qoder CLI tells you to enable it in /security-settings; implicit L3 handoff checks stay silent when L3 is disabled.

Run Repository Scans in CI/CD

security scan provides an L4 repository scan. It is a deterministic, non-interactive command that does not start a conversation or depend on a Skill, so you can invoke it directly from a CI/CD script. Scan the whole repository:

qoder --cwd /path/to/repository security scan --all

Scan selected files or directories:

qoder --cwd /path/to/repository security scan src/auth src/payment

--cwd sets the repository working directory. Because a CI job might not run from the checkout directory, we recommend always setting it explicitly. You cannot combine --all with path arguments. If neither is provided, the command displays help without starting a scan. Whole-repository and selected-path scans invoked through this CI/CD command are not subject to a 10,000-line limit. No additional option is required. Larger repositories generally take longer to scan. Common options:

Option	Description
`--report <format[=path]>`	Generate a report; repeat the option to create multiple reports
`--fail-on <severity>`	Exit non-zero when findings at this severity or higher exist; defaults to `high`
`--wait-timeout <seconds>`	Maximum time to wait for the scan result; defaults to `3600`
`--config <path>`	Use an advanced scan configuration file

For example, generate a SARIF report and fail the pipeline on High or Critical findings:

qoder --cwd "$CI_PROJECT_DIR" security scan --all \
  --fail-on high \
  --report sarif=qoder-security.sarif

Use --fail-on none to observe an initial baseline without failing on findings. It does not suppress authentication, network, scan execution, report writing, or timeout errors; those errors still produce a non-zero exit code. The environment must have valid Qoder CLI authentication and network access to the security scan service. The first run can include additional preparation time. Service-side analysis runs in stages and can take several minutes even for a small target. Early analysis is usually the longest stage, and intermediate results require further confirmation, so the command can remain quiet for a while and print results and reports near completion. This silence does not by itself mean the process is stuck. Set the CI job timeout higher than --wait-timeout and reserve time for report upload. View all options:

qoder security scan --help

When to Use It

Security scanning is useful in scenarios such as:

Qoder CLI generated or modified security-sensitive code, such as authentication, payment, data export, file upload, or command execution logic.
You want to quickly check whether the current changes introduced high-risk issues before committing or handing off code.
You want security-focused feedback before a code review.
You are using automated modes and want to keep a continuous safety check enabled.
You want to scan a repository or critical directories in CI/CD and gate the pipeline by severity.

Notes

Security scanning focuses on the current task and incremental changes. Project/file scan can scan the whole repository or selected paths, but it is still not a complete security audit and does not guarantee that every vulnerability will be found. Results depend on the current code context, accessible files, and enabled scan levels. For critical business code, combine it with human security review, tests, dependency scanning, and your organization's security process. If security scanning does not behave as expected, check the following:

The relevant scan level is on in /security-settings.
Your user-level settings.json does not explicitly disable fields under securityScan.
If you edited the settings file manually, the JSON is valid and saved to user-level settings.
The current task produced new or modified code that can be scanned.

Permissions: Learn about tool approval, permission modes, and allow/deny rules.
Hooks: Learn how Qoder CLI runs automation during tool calls and session lifecycle events.
Skills: Learn how Skills extend Qoder CLI with specialized capabilities.

​Entry Point

​Scan Levels

​L1 Static Check

​L2 Lightweight Scan

​L3 Deep Scan

​Configure Scan Levels

​Use the Settings File

​How Automatic Scanning Works

​Manual Security Scan

​Run Repository Scans in CI/CD

​When to Use It

​Notes

​Related Docs