Code Security support matrix

The following content provides a high level list of scanners that are currently supported by Code Security. Select a scanner from the list or see Features for more information.

Scanner	Description
Infrastructure-as-Code Security	Scans your IaC configuration files to detect configuration issues. The languages supported by IaC are Cloudformation, Dockerfiles, Helm Charts, Kustomize, Terraform, and Terraform-plan. See Supported languages. FortiCNAPP's IaC static analyzer, Opal, evaluates IaC files for potential AWS, Azure, Google Cloud, and Kubernetes security and compliance violations prior to deployment. See Opal Engine.
Software Composition Analysis (SCA)	Scans for vulnerabilities in the open-source libraries and components used by the application. The programming languages supported by the SCA scanner are .NET, C/C++, Go, Java, NodeJS, PHP, Python, Ruby, and Rust. See Languages supported by SCA. The SCA binary component used in the lacework component install sca CLI command allows you to scan SCA, SAST, and secrets. See Overview.
Static application security testing (SAST)	Scans the source code of an application during development to minimize zero-day vulnerabilities. The application languages supported for SAST are Go, Java, JavaScript, PHP, Python, and Typescript. See Languages supported by SAST.
Secrets detection	The secret scanner detects secrets found in your first party source code, including IaC and Application code. The secret scanner scans hard coded secrets such as passwords, API keys, tokens, and more. See Detectable secrets.
License compliance	Detects the licenses found in your software projects based on the 3rd party packages you are importing. See License compliance.

Source control management (SCM) integrations

FortiCNAPP Code Security can integrate with the following SaaS SCM providers:

• GitHub

• GitLab

• BitBucket

See Integrating with an SCM and Requirements.

Supported CI/CD pipeline tools

CI/CD providers currently supported for IaC include:

• Atlantis

• Azure DevOps

• GitHub actions

• GitLab pipeline

• GitLab self-hosted pipeline

• Jenkins

Furthermore, CI/CD providers currently supported for SCA and SAST include:

• GitHub actions

• GitLab pipeline

For more information, see Integrate with a CI/CD pipeline and Requirements.