Use progressive security scans to find and fix risks before code is committed or pushed.
Code security brings risk detection into the development flow. Use Static Check, Lightweight Scan, and Deep Scan at different stages: fast checks while code is being written, semantic review near task completion, and deeper cross-file analysis before important changes leave the device.
Static Check runs after code-writing actions and checks for high-risk patterns such as dangerous calls or obvious credential exposure. It is the free baseline scan.
Lightweight Scan reads incremental code semantically to find risks such as SQL injection, remote command execution, and sensitive-information leakage. Ask Qoder to perform a lightweight security scan when the implementation is nearly complete.
Deep Scan follows data across files and functions. Use it for authentication, authorization, external input, data access, or other changes where a risk may only appear after multiple code paths are connected.
After a scan:
Static Check is free. Lightweight Scan and Deep Scan consume Credits, and a scan cannot continue after available Credits are exhausted. Reference estimates are about 5 Credits per 500 lines for Lightweight Scan and 20 Credits per 500 lines for Deep Scan; actual usage varies with scope, code complexity, and findings.
Open Code security
- Open Settings.
- Under Coding, select Security.
- Review the switches for Static Check, Lightweight Scan, and Deep Scan.
Choose a scan
| Scan | Scope | Recommended time |
|---|---|---|
| Static Check | Code generated in the current task and common high-risk patterns | Keep enabled while coding. |
| Lightweight Scan | Semantic risks in incremental code | Near the end of a coding task. |
| Deep Scan | Cross-file and cross-function data flow in incremental code | Before committing or pushing important changes. |
Static Check
Static Check runs after code-writing actions and checks for high-risk patterns such as dangerous calls or obvious credential exposure. It is the free baseline scan.
Lightweight Scan
Lightweight Scan reads incremental code semantically to find risks such as SQL injection, remote command execution, and sensitive-information leakage. Ask Qoder to perform a lightweight security scan when the implementation is nearly complete.
Deep Scan
Deep Scan follows data across files and functions. Use it for authentication, authorization, external input, data access, or other changes where a risk may only appear after multiple code paths are connected.
Review and fix findings
After a scan:
- Review the severity, file, line, and explanation.
- Confirm the input source, dangerous operation, and reachable path.
- Ask the Agent to prepare a fix, or edit the code yourself.
- Inspect the final diff in Review.
- Run relevant tests and repeat the appropriate scan.
Credits
Static Check is free. Lightweight Scan and Deep Scan consume Credits, and a scan cannot continue after available Credits are exhausted. Reference estimates are about 5 Credits per 500 lines for Lightweight Scan and 20 Credits per 500 lines for Deep Scan; actual usage varies with scope, code complexity, and findings.
Start with the smallest scope that covers the affected call path. A narrow scan is faster, but it should not omit related files that determine whether the issue is exploitable.