>Rule registry
Every rule is readable. Every rule is yours to change.
Codevanta ships with 2,400+ rules across eight vulnerability categories — and because they're written in a readable pattern syntax, your team can inspect exactly why a finding fired, or write one of your own in the same format.
Rule categories
340 rules
Injection
180 rules
Secrets & credentials
210 rules
Authentication & sessions
165 rules
Cryptography
290 rules
IaC misconfiguration
95 rules
Deserialization
175 rules
Access control
140 rules
Supply chain
>Writing your own
Your internal security patterns, in the same registry
A custom rule is a YAML file with a pattern, a message, and a severity — no new language to learn, and no separate system to maintain alongside the built-in rules.
rules: - id: hardcoded-flask-secret-key pattern: app.config['SECRET_KEY'] = "..." message: Flask SECRET_KEY should come from env, not source severity: CRITICAL languages: [python]
What makes a rule trustworthy
- Every built-in rule is open to read — nothing fires without an explanation you can inspect
- Custom rules use the same pattern syntax as the built-in registry, no separate DSL to learn
- Rules can be scoped to one repo, a team, or your whole org
- Disable or tune any rule per-repo without opening a support ticket
Bring your own rules, or start with ours.
Every team starts with the full built-in registry, then layers on custom rules as they find patterns specific to their codebase.
Talk to us$ codevanta scanScanning 214 files across 6 languages...✓ No critical findings in auth/✗ 2 findings in api/handlers.pyDone in 8.2s — report posted to PR #482