Security Code Scan

What Security Code Scan is

Security Code Scan is a free, open-source static analyzer for .NET code written in C# and VB.NET. It looks for vulnerability patterns including SQL injection, cross-site scripting, CSRF, and XML external entity injection. Its inter-procedural taint analysis follows input data across code. The analyzer can run in the background as IntelliSense or during a build. For automated workflows, the project lists GitHub and GitLab pipeline support, MSBuild, and a stand-alone runner for custom integrations. Those custom integrations can produce SARIF results and display warnings alongside other build messages. Users can configure taint sources, sinks, sanitizers, validators, and project-specific settings. It supports Visual Studio 2019 or higher; the project says other Roslyn analyzer editors such as Rider or OmniSharp should work. Downloads include a NuGet package, a Visual Studio extension, and a stand-alone runner. The maker warns that installing the extension or NuGet package can slow the IDE because the analyzer performs extensive static analysis, and recommends CI/CD pipelines as the more common use case.

Who it suits

Security Code Scan suits .NET developers who want vulnerability analysis in an editor, during builds, or in CI/CD pipelines. Teams can also define custom taint rules and project settings.

Limits

The free plan is an open-source static analyzer for .NET source code. Automated fixes are not included; enabling audit mode can also produce additional warnings about data with unknown taint state.

Getting started

1. Visit the Security Code Scan website.
2. Choose a NuGet package, Visual Studio extension, or stand-alone runner release.
3. Use it with Visual Studio 2019 or later, or another Roslyn analyzer editor such as Rider or OmniSharp.
4. For automated analysis, configure a GitHub or GitLab pipeline, MSBuild, or a custom runner integration.
5. Configure project settings and any custom taint sources, sinks, sanitizers, or validators as needed.

Verdict

Security Code Scan offers configurable static analysis for .NET projects, with options for editor and pipeline workflows. The maker recommends CI/CD for common use and warns that IDE installations can slow performance.