How to review a public repository security scan

Understand enabled code, dependency, secret and infrastructure checks, distinguish advisories from exploitation, and prioritise fixes with evidence.

Understand prerequisites and report privacy

Noxarix accepts public repository URLs; private repositories are not supported. Sign-in and a configured backend are required, and the result is saved as a private report. Only submit a repository you own or have permission to inspect. Record the revision so later results can be compared meaningfully; default branches can change between runs.

Separate the available engines

Repository scanning can inspect source patterns, dependency advisories, secrets, container configuration and infrastructure-as-code using enabled engines. Availability depends on deployment configuration and the repository contents. Read the coverage section first: skipped or failed engines do not mean that their risk category is clear. A repository scan does not exercise the deployed application’s authenticated routes.

Triage a dependency advisory

Check the affected package, resolved version, vulnerable range and upgrade guidance shown in the finding. An advisory is not proof of an exploitable path in your application. Determine whether the package ships to production, whether the affected functionality is reachable and whether a compatible fixed version exists. Avoid blindly forcing major upgrades; review changes and test your application.

Review code and infrastructure findings

Use the file location and rule explanation to review the surrounding code. A source-pattern warning needs context about validation, authorisation and how data reaches the operation. A container or infrastructure warning may require a deployment change rather than a source edit. If a credential appears in git history, revoke it before cleaning history. Never copy the secret into a public remediation ticket.

Close the loop with a new revision

Apply a focused fix, run the project’s checks and scan the revised public repository. Compare revisions and coverage as well as finding counts. A smaller count is not meaningful if an engine stopped running. Complement this review with a URL scan of your authorised deployment and manual tests for permissions, workflow abuse and business logic. No automated scan guarantees security.