What Cysmiq detects in code

Use this article when you want to understand what Cysmiq code scanning can detect, or whether a finding is expected for a language, framework, or impact category.

What code scanning covers

• Source-code vulnerabilities: insecure patterns in application code, services, and supported frameworks.
• Common attacker outcomes: findings are grouped by impact, such as command execution, unauthorized access, data access, file access, traffic interception, client-side attacks, and performance degradation.
• Language and framework coverage: Cysmiq maintains rule packs for JavaScript/TypeScript, Python, Java, Kotlin, Scala, Swift, Dart, Go, Elixir, Ruby, Rust, PHP, and C#/.NET, plus selected frameworks and libraries.

How findings are reviewed

• Pattern checks: the matched pattern is treated as vulnerable, with a local same-file check for mitigating usage.
• Context checks: the matched pattern is treated as vulnerable, then a local review evaluates how the risky construct is used. Unclear cases can trigger deeper analysis.
• Data-flow checks: Cysmiq validates that untrusted input can reach sensitive behavior, then uses local and call-chain context to determine exploitability.

What to check first

• Open the vulnerability detail page and review the evidence, locations, impact, and analysis context.
• Confirm that the repository language and framework are covered in the code security rules reference.
• If a supported pattern is not detected, check that the relevant file was included in the scanned ref and not excluded by repository configuration.

Canonical docs

For the maintained explanation, see Code scanning. For current language, framework, and impact coverage, see Code security rules.

Contact support if

• You expect a code vulnerability to appear but no finding is created.
• A finding appears to have the wrong impact, severity, confidence, or validation state.
• The analysis context does not explain why Cysmiq considered the finding exploitable or not exploitable.