Code Security repository scanning process

This section describes how FortiCNAPP Code Security processes your code during security scans, including data handling and privacy considerations.

Scanning workflow

When Code Security scans your repositories, the following steps occur:

1. Event detection

2. Repository cloning

3. Ephemeral processing

4. Results upload

5. Cleanup

6. Status delivery

Event detection

When you integrate your GitHub, GitLab, or Bitbucket organization with Code Security, the integration grants permissions to listen for Git events from your SCM provider. These events include pull request creation, commits to PR branches, repository onboarding, and new repository creation.

Repository cloning

When a scan is triggered, Code Security initiates a clone of your repository into a per-customer sandboxed job environment. These jobs run in isolated infrastructure located in the AWS us-west-2 region.

Ephemeral processing

The repository is cloned to an ephemeral Kubernetes process with ephemeral storage. No persistent storage is used for your source code. Once the clone is complete, Code Security triggers the relevant scanning tools (IaC, SCA, SAST, Secrets, and License compliance) against your codebase.

Results upload

Upon completion of the security assessment, only the assessment results are uploaded to FortiCNAPP storage. Results are stored in geographically appropriate storage shards based on the region of your FortiCNAPP account. Your source code is never persisted or transferred outside the ephemeral processing environment.

Cleanup

After the assessment results are uploaded, all cloned repository data is deleted along with the ephemeral processing job. No source code remains in the scanning infrastructure after the job completes.

Status delivery

For pull request scans, Code Security delivers success, failure, or timeout status back to your Git provider. This status appears in your SDLC workflow as a status check on the pull request, allowing you to enforce security gates before merging.

Data residency

Data type	Location	Retention
Source code during scan	AWS us-west-2 (ephemeral)	Deleted immediately after scan
Assessment results	Regional storage shard (based on account region)	Per your FortiCNAPP data retention policy

Related topics

See the following topics for more information:

• Integrated Code Security scanning triggers

• Troubleshooting failed Git status checks

• Integrating with an SCM