Code security brings risk detection into the development flow. Use Static Check, Lightweight Scan, and Deep Scan at different stages: fast checks while code is being written, semantic review near task completion, and deeper cross-file analysis before important changes leave the device.
Open Code security
- Open Settings.
- Under Coding, select Security.
- Review the switches for Static Check, Lightweight Scan, and Deep Scan.
After you enable a switch, Qoder recommends the corresponding scan at suitable points and performs the scan and fixes after confirmation. Review the findings and repair diff before deciding whether to commit or push.
Choose a scan
Scan depth and speed involve a tradeoff. Static Check provides fast feedback during coding, Lightweight Scan examines semantic risks in changed code, and Deep Scan follows data across files and functions. Broader scopes and more complex paths generally require more time and Credits. Match the scan to the risk of the change rather than running a broad scan for every small edit.
| Scan | Scope | Recommended time |
|---|
| Static Check | Code generated in the current task and common high-risk patterns | Keep enabled while coding. |
| Lightweight Scan | Semantic risks in incremental code | Near the end of a coding task. |
| Deep Scan | Cross-file and cross-function data flow in incremental code | Before committing or pushing important changes. |
Static Check
Static Check examines code generated in the current task, matches common high-risk patterns such as dangerous function calls, and supports automatic fixes. It is the free baseline scan for use during coding.
Lightweight Scan
Lightweight Scan reads incremental code semantically to find risks such as SQL injection, remote command execution, and sensitive-information leakage. Ask Qoder to perform a lightweight security scan when the implementation is nearly complete.
For example, when user input is concatenated into a shell command, a review must consider both whether the input is controllable and whether the call executes a command. Lightweight Scan targets these semantic risks in incremental code.
Deep Scan
Deep Scan follows data across files and functions. Use it for authentication, authorization, external input, data access, or other changes where a risk may only appear after multiple code paths are connected.
For example, a request parameter may pass through a filter in another file before reaching a SQL query. The call chain must be examined to determine whether the filter protects the actual query context. Deep Scan targets related risks that are difficult to see within one file.
Review and fix findings
After a scan:
- Review the severity, file, line, and explanation.
- Confirm the input source, dangerous operation, and reachable path.
- Ask the Agent to prepare a fix, or edit the code yourself.
- Inspect the final diff in Review.
- Run relevant tests and repeat the appropriate scan.
Full and targeted scans: Ask for a full security scan of the current project to audit the entire repository, or name specific files or directories for a narrower scan. These scans upload the selected code to the cloud and consume Credits, so confirmation is requested before execution. A full scan also asks whether to include dependency analysis. A whole-repository scan that includes both code and dependency analysis generally consumes the most Credits; use it when needed.
After submission, the cloud scan returns a report entry while scanning continues. Open the report later or ask for the result in the current task. Receiving the report entry does not mean the scan has finished.
Credits
Static Check is free. Lightweight Scan and Deep Scan consume Credits, and scanning cannot continue after available Credits are exhausted.
| Scan | Reference usage |
|---|
| Static Check | Free |
| Lightweight Scan | About 5 Credits per 500 lines |
| Deep Scan | About 20 Credits per 500 lines |
| Full scan | Increases with code volume and analysis scope; including dependency analysis consumes more |
A full scan covers the entire repository and can take several minutes, with potentially substantial time and Credits usage. Prefer incremental scans for everyday changes. For a scan of specific files or directories, state the scope explicitly while retaining the related code needed to assess the risk.
Security scanning does not replace tests, dependency auditing, secret management, or human review. Rotate credentials that were already exposed.
