> ## Documentation Index > Fetch the complete documentation index at: https://docs.qoder.com/llms.txt > Use this file to discover all available pages before exploring further. # Security > Qoder Security embeds security into your dev workflow — three-tier progressive scanning and one-click fixes, keeping every line secure before commit. AI has multiplied how fast developers write code — and how fast attackers find and exploit vulnerabilities. Traditional scanners fire late in the pipeline, drown developers in false positives, and can't explain themselves. **Qoder Security shifts detection and remediation to the moment you write each line.** Every finding comes with a fix suggestion; Qoder's main Agent applies the fix, and you review the final diff. ## Core capabilities * **LLM-driven:** Instead of matching regex patterns, the model reads code semantics — it can tell whether a value is attacker-controlled, whether a call actually reaches a sink, and whether a team's own utility method really neutralizes the risk. * **Multi-Agent cross-verification:** Findings are challenged and confirmed by multiple Agents from different angles before you see them, which cuts false positives and stabilizes recall. * **Layered by design:** Fast checks run in the coding loop. Semantic diff scans run at the end of a task. Cross-file data-flow analysis runs before you push. A repo-wide audit is one command away. ## How the tiers work together Security and speed usually pull against each other: deep scans are slow, fast scans are shallow. The layered design pairs each strength with the right moment — **fast when it should be fast, deep when it should be deep**. | Tier | Target | Depth | When it runs | | --------------------- | ------------------------------------------------------------------------ | ----------------------------- | --------------------------------------- | | Static Check (L1) | Code generated in the current task | Pattern match, near-zero cost | Automatically during coding | | Lightweight Scan (L2) | Incremental code | Semantic, diff-scoped | Recommended at the end of a coding task | | Deep Scan (L3) | Incremental code, tracing complete data flows across files and functions | Cross-file data-flow | Recommended before push | From inline checks in the coding loop, to per-diff review, to pre-push deep audits, to on-demand repo-wide scans — security becomes a default that lives inside every keystroke and every commit. ## Turn on Code Security 1. Open Qoder and go to **Settings**. 2. Pick **Security** from the sidebar. 3. Under **Scanning Tiers**, confirm the toggles for **Static Check (L1)**, **Lightweight Scan (L2)**, and **Deep Scan (L3)**. ## Credits estimates L2 and L3 consume Credits — scans are blocked when your Credits run out. L1 Static Check is free. See [Credits](/Credits) for details. Rough consumption (based on internal testing; actual usage depends on code complexity, number of vulnerabilities, and other factors): * **Lightweight Scan (L2)**: \~5 Qoder Credits per 500 lines * **Deep Scan (L3)**: \~20 Qoder Credits per 500 lines ## Scanning tiers ### Static Check (L1) **For code generated in the current task.** Based on high-risk pattern matching, it instantly detects common risks like dangerous function calls and auto-applies the fix. * **When it runs**: automatically, right after every code-writing step in the session. No manual trigger, no confirmation needed. * **How you see it**: findings are surfaced inline in the current chat. Results feed straight back into the session context and the model handles them in the next revision. * **Use it for**: the everyday AI-generated-code loop, where a model may quietly reach for `eval()` or paste a real API key into a config. L1 is the always-on baseline that keeps obvious risks from landing in the file. ### Lightweight Scan (L2) **For incremental code.** Deeply understands code semantics to precisely identify risks such as SQL injection, remote command execution, and sensitive-data leaks. * **When it runs**: recommended when a single coding task is close to wrapping up — Qoder surfaces a recommendation card in the chat at the right moment: > **Scan your code for hidden risks** Clicking auto-fills: ``` /security-scan Run a lightweight scan for me ``` You can also type this yourself, or ask in plain language ("run a lightweight scan", "check my changes for risks"). Ignore the card if you don't want to scan — the rest of the flow is unaffected. * **How it works**: say you just spliced a request parameter straight into a system command. L2 simultaneously reasons about "this parameter is attacker-controlled" and "this call really executes a command," and flags command injection. Regex-based scanners cannot bridge those two facts. * **How you see it**: risk location, description, and a suggested fix appear inline in the chat, with a Review panel diff on the right. * **Use it for**: catching finish-line risks in a diff — the SQL string you just concatenated, the request parameter you piped into a shell, the API key that slipped into a config value. ### Deep Scan (L3) **For incremental code, tracing complete data flows across files and functions.** Uncovers hidden linked vulnerabilities invisible from a single-file view, for more comprehensive analysis. * **When it runs**: typically recommended by the model before commit / push. When it detects a push intent in the session, it may surface an **Ask Question** card asking whether to run a security scan first. If your intent to scan is already explicit, the scan runs directly. * **Other entry points**: in the Quest window, the Commit dropdown has a **Scan & Push** entry when L3 is on — clicking auto-fills `/security-scan Run a deep scan and push`. * **How it works**: an external parameter flows across files into a SQL concatenation, passing a team-authored sanitizer function along the way. L3 actually reads the method's implementation: it sees the method only strips single quotes, notices the parameter is being spliced into an `order by` clause where single-quote filtering doesn't help, and concludes injection is still possible. * **How you see it**: results are shown inline in the chat flow — the exact form is model-decided, but typically covers severity, location, description, and a suggested fix. When it fits, an Ask Question card follows so you can hand the remediation to the Agent or skip. * **Use it for**: the last checkpoint before your code leaves your machine. L3 excels at the "safe when viewed alone, unsafe when connected" class — SQL injection chains passing through custom sanitizer functions, path traversals that traverse decoding boundaries, taint that only becomes exploitable after crossing several files. ## Full Scan **For repository-wide audits.** Chain two slash commands in the chat — `/security-scan` to run the scan, then `/canvas` to render the results as a visual report: ``` /security-scan run full scan and /canvas generate a visual security report ``` Full Scan runs on the whole repository — both wall time and Credits usage can be significant. A single `/security-scan` invocation is capped at 10,000 lines of code; if your repo is larger, split by directory or by commit range. Qoder walks the repository and generates a **Visual Security Scan Report** as a Canvas artifact — open it from the chat like any other Quest output. A typical report may include a scan status header (target, completion time, remediation state), a Findings summary table (Severity / Title / CWE·OWASP / Location), and per-finding details with affected code and remediation guidance. ## Manual scans You can also start a scan yourself at any time — narrower than a Full Scan. * **Slash command**: type `/security-scan` in the chat and describe what you want. Examples: ``` /security-scan Run a lightweight scan for me /security-scan Run a deep scan and push /security-scan Scan the src/api directory /security-scan Scan the last 3 commits ``` * **Natural language**: "scan my code", "check for security risks", "run a deep scan", "scan the `mydir` folder" — the Agent maps these to the right scope and tier.