The CodeScoring secure development platform integrates into the software development lifecycle and helps apply different security policies at different stages:

• local environment and IDEs;
• repositories and development platforms;
• CI/CD pipeline;
• post-release monitoring.

The general integration scheme is presented below:

Important: the main platform functionality is listed by stages. The full list of capabilities is available on the functional characteristics page.

#Local environment and IDEs

At the local development stage, CodeScoring helps prevent vulnerable or malicious components from entering the codebase and shows issues before changes are pushed to a repository.

IDE plugins let developers see vulnerable dependencies directly in project files, get information about policy violations, and track remediation progress. For local checks, the universal Johnny agent can also be used.

Functionality:

• highlighting vulnerable dependencies in IDEs;
• updating dependencies to safe versions without leaving the IDE;
• analysis and blocking of third-party components when they are downloaded from proxy repositories;
• composition analysis of a local project;
• search for confidential information in the source code.

#Repositories and development platforms

At the stage of storing and managing source code, CodeScoring provides continuous quality and security control for repositories.

Integration with major development platforms using git is supported: GitFlic, GitHub, GitLab, Bitbucket, Azure DevOps and others.

Functionality:

• inventory of third-party components in repositories;
• detection of vulnerabilities and potentially dangerous components;
• search for secrets;
• analysis of development quality.

#Assembly in CI/CD pipeline

At the assembly stage, CodeScoring analyzes software in the CI/CD pipeline and checks the artifacts used before an unsafe component reaches a release.

Supported automation tools: GitLab CI/CD, Jenkins, TeamCity, Bamboo, GitFlic, and others.

Functionality:

• automatic generation of a software bill of materials (SBOM);
• detection of vulnerabilities and potentially dangerous components;
• analysis of license compatibility;
• control of the build's compliance with security policies.

The analysis is performed using the Johnny agent, available as a binary file or container image. If security policies are violated, the agent terminates execution with the corresponding error code, which allows to stop the build before the unsafe artifact gets into the release.

#Post-release monitoring

After the product is published, CodeScoring provides continuous monitoring of source code security and component composition. This makes it possible to respond to new vulnerabilities and threats in already released versions.

Functionality:

• scheduled scanning of code repositories and SBOM;
• automatic updates of threat data;
• notifications via email, task managers, and ASPM/ASOC/SIEM systems;
• scan history and reports.