Security

​

Core capabilities

• LLM-driven: Instead of matching regex patterns, the model reads code semantics — it can tell whether a value is attacker-controlled, whether a call actually reaches a sink, and whether a team’s own utility method really neutralizes the risk.
• Multi-Agent cross-verification: Findings are challenged and confirmed by multiple Agents from different angles before you see them, which cuts false positives and stabilizes recall.
• Layered by design: Fast checks run in the coding loop. Semantic diff scans run at the end of a task. Cross-file data-flow analysis runs before you push. A repo-wide audit is one command away.

​

How the tiers work together

​

Turn on Code Security

1. Open Qoder and go to Settings.
2. Pick Security from the sidebar.
3. Under Scanning Tiers, confirm the toggles for Static Check (L1), Lightweight Scan (L2), and Deep Scan (L3).

​

Credits estimates

• Lightweight Scan (L2): ~5 Qoder Credits per 500 lines
• Deep Scan (L3): ~20 Qoder Credits per 500 lines

​

Scanning tiers

​

Static Check (L1)

• When it runs: automatically, right after every code-writing step in the session. No manual trigger, no confirmation needed.
• How you see it: findings are surfaced inline in the current chat. Results feed straight back into the session context and the model handles them in the next revision.
• Use it for: the everyday AI-generated-code loop, where a model may quietly reach for eval() or paste a real API key into a config. L1 is the always-on baseline that keeps obvious risks from landing in the file.

​

Lightweight Scan (L2)

• When it runs: recommended when a single coding task is close to wrapping up — Qoder surfaces a recommendation card in the chat at the right moment:

  Scan your code for hidden risks

  Clicking auto-fills:
  /security-scan Run a lightweight scan for me
  
  You can also type this yourself, or ask in plain language (“run a lightweight scan”, “check my changes for risks”). Ignore the card if you don’t want to scan — the rest of the flow is unaffected.
• How it works: say you just spliced a request parameter straight into a system command. L2 simultaneously reasons about “this parameter is attacker-controlled” and “this call really executes a command,” and flags command injection. Regex-based scanners cannot bridge those two facts.
• How you see it: risk location, description, and a suggested fix appear inline in the chat, with a Review panel diff on the right.
• Use it for: catching finish-line risks in a diff — the SQL string you just concatenated, the request parameter you piped into a shell, the API key that slipped into a config value.

​

Deep Scan (L3)

• When it runs: typically recommended by the model before commit / push. When it detects a push intent in the session, it may surface an Ask Question card asking whether to run a security scan first. If your intent to scan is already explicit, the scan runs directly.
• Other entry points: in the Quest window, the Commit dropdown has a Scan & Push entry when L3 is on — clicking auto-fills /security-scan Run a deep scan and push.
• How it works: an external parameter flows across files into a SQL concatenation, passing a team-authored sanitizer function along the way. L3 actually reads the method’s implementation: it sees the method only strips single quotes, notices the parameter is being spliced into an order by clause where single-quote filtering doesn’t help, and concludes injection is still possible.
• How you see it: results are shown inline in the chat flow — the exact form is model-decided, but typically covers severity, location, description, and a suggested fix. When it fits, an Ask Question card follows so you can hand the remediation to the Agent or skip.
• Use it for: the last checkpoint before your code leaves your machine. L3 excels at the “safe when viewed alone, unsafe when connected” class — SQL injection chains passing through custom sanitizer functions, path traversals that traverse decoding boundaries, taint that only becomes exploitable after crossing several files.

​

Full Scan

/security-scan run full scan and /canvas generate a visual security report

​

Manual scans

• Slash command: type /security-scan in the chat and describe what you want. Examples:
  /security-scan Run a lightweight scan for me
  /security-scan Run a deep scan and push
  /security-scan Scan the src/api directory
  /security-scan Scan the last 3 commits
  
• Natural language: “scan my code”, “check for security risks”, “run a deep scan”, “scan the mydir folder” — the Agent maps these to the right scope and tier.