Docs Code Scanning Scanning Best Practices How Aikido scans code and dependencies, and how to tune it for your repositories, languages, and build tools.
This section covers how Aikido's static application security testing (SAST), software composition analysis (SCA), and secret detection work under the hood, and how to configure them for your setup.
For automatic SAST noise reduction powered by Aikido Agent , see SAST AutoTriage .
SAST and custom rules
SAST/IaC: Supported Languages and Security Focus Multi-File / Cross-File Vulnerability Tracing Access Control Checks Custom Rules Overview Add Custom SAST & IaC Rules Custom Code Context for SAST Rules Excluding SAST Findings Using Comments Secret detection
Live Secret Detection Denoise via Secret Keyword Filter Ignoring Secrets via Code Comments Dependency scanning (SCA)
Support for Dependency Scanning by Language (SCA) External Vulnerability Databases Used in Our SCA Engine Scanning Dev Dependencies for CVEs Custom CVE Vulnerabilities Define vulnerabilities for internal or private packages that are not in public CVE databases. Exploit Intelligence with KEV and EPSS Learn how Aikido uses EPSS and the CISA KEV catalog to prioritize dependency CVEs, and how to configure optional EPSS-based noise reduction. Malware Detection in Open-Source Dependencies and Containers Vulnerability Scanning on Private Packages - Maven C/C++ Lockfile-Less Scanning Dependency Scanning for Bazel Scala: Dependency Management and Scanning for build.sbt Java/Scala/Kotlin Projects Using Gradle: Security Scanning Best Practices NET Projects: Security Scanning Best Practices Python Projects: Security Scanning Best Practices Branches and repositories
Scanned Branches in Aikido Support for Multi-Branch Scanning Support for Specific Branch Scanning Ensuring Aikido Scans New Repositories Split Your Monorepo Per Path Other
Configure scanning with .aikido files 