Code Assets

The Code asset type provides centralized visibility into source code repositories assessed by Qualys.

Code Assets represent the development-side entry point into the application lifecycle and allow security teams to understand vulnerabilities, AI compliance risks, and the downstream cloud artifacts associated with a repository.

Code Assets are available under:

Assets > Code

What Is a Code Asset?

A Code Asset represents a source code repository that has been discovered or scanned through QScanner.

Each Code Asset provides a consolidated view of security findings and contextual information associated with that repository.

Depending on the scan and available metadata, Qualys can identify:

• Software dependencies and vulnerable packages
• Software Composition Analysis (SCA) findings
• AI-related compliance findings
• Repository and pipeline metadata
• Associated container images
• TruRisk™ and risk prioritization information

This allows teams to manage source code as a first-class security asset alongside hosts, cloud resources, container images, Kubernetes resources, and other assets managed by Qualys.

Types of Code Assets Supported

Any Git repository is supported, including:

• GitHub
• GitLab
• Bitbucket

Key Use Cases

Software Composition Analysis

Qualys analyzes software packages and dependencies identified within the repository to detect known vulnerabilities.

SCA visibility helps security and development teams understand which third-party and open source components are being introduced into an application before the application is deployed.

Findings can then be correlated with additional Qualys intelligence to help prioritize remediation.

AI Compliance

Code scanning can also identify AI-related components and provide visibility into potential AI compliance and governance considerations.

This allows organizations to include AI-enabled application development within their broader security and compliance programs rather than evaluating AI risk independently from the rest of the application stack.

TruRisk™ for Code

Qualys applies TruRisk™ to help security teams prioritize risk associated with Code Assets.

TruRisk™ provides a consistent prioritization model across Qualys, allowing code-related findings to be evaluated alongside risks identified in container images, cloud infrastructure, and runtime environments.

Instead of relying solely on vulnerability severity, teams can use Qualys risk intelligence and available asset context to determine which findings require the most immediate attention.

Code-to-Cloud Traceability

One of the key capabilities of Code Assets is the ability to connect a source repository with the artifacts produced from that code.

When QScanner executes within a CI/CD pipeline, it collects pipeline metadata that enables Qualys to establish relationships between the source repository and associated container images.

For example:

Code Repository -> CI/CD Pipeline -> Container Image

The Associated Images information on the Code Asset allows users to identify container images that were built using the repository.

Those images can subsequently be correlated with Qualys container and cloud inventory to determine where the software has been deployed.

This creates a continuous relationship across:

Code -> Build -> Image -> Registry -> Cloud -> Runtime

Why Code-to-Cloud Context Matters

Security findings discovered during development do not all have the same downstream impact.

A vulnerable dependency in an experimental repository may represent significantly different risk from the same dependency in code that produces an image currently running in production.

By connecting Code Assets with associated images, Qualys enables teams to determine whether a finding identified in source code propagates into downstream application artifacts.

For example, a user investigating a vulnerable dependency can:

1. Identify the vulnerability on the Code Asset.
2. Review the container images associated with the repository.
3. Determine whether those images contain the affected software.
4. Identify where the images are deployed within the cloud environment.
5. Use additional runtime and cloud context to prioritize remediation.

This enables security teams to move beyond isolated findings and understand application risk across the complete software lifecycle.

Code Asset Details

The Code Asset details page can include information such as:

• Asset Information: Repository name, repository metadata, source control information, and scan information.
• Risk: TruRisk™ and security findings associated with the repository.
• Software: Packages and dependencies identified through Software Composition Analysis.
• AI Compliance: AI-related compliance and governance findings identified during scanning.
• Associated Images: Container images linked to the repository using metadata collected during CI/CD pipeline execution.

From Code to Runtime

Code Assets extend Qualys visibility to the earliest stages of application development while preserving relationships with downstream infrastructure.

Together with QScanner, Container Security, Cloud Security, and runtime visibility, Code Assets allow teams to follow risk across the application lifecycle:

Identify in Code -> Validate in Image -> Understand Deployment -> Prioritize with Runtime Context

This provides development, application security, and cloud security teams with a shared view of risk from code to cloud.

QScanner IDE Extensions

Qualys QScanner is available as an IDE extension, bringing vulnerability scanning and compliance checks directly into your development environment. Developers can scan source code repositories for SCA findings and AI compliance issues without leaving their IDE - enabling security to be addressed earlier in the development lifecycle.

The extension performs a local scan using the QScanner binary. Only package metadata is transmitted to the Qualys Enterprise TruRisk™ Platform; source code is never sent. Findings are displayed within the IDE with QDS (Qualys Detection Score) severity scoring, and vulnerable dependencies can be patched with a single click.

Developers can remediate vulnerabilities directly from the IDE - no need to switch tools or manually update package versions. The extension automatically applies the recommended fix using the appropriate package manager, with the option to patch individual findings or all patchable vulnerabilities at once.

QScanner IDE extensions are available for the following editors:

• QScanner VS Code Extension — for Visual Studio Code, Windsurf, Cursor, and other VS Code-based editors.
• QScanner JetBrains Extension — for IntelliJ IDEA, PyCharm, GoLand, WebStorm, and other JetBrains IDEs.

For a full list of Qualys integrations, see Qualys Connectors.