Searching for Code
Use the search tokens below to search for code repositories scanned by Qualys. Looking for help with writing your query? click here.
repository.namerepository.name
Use a text value ##### to find code repositories by repository name.
Example
Show code repositories with this name.
repository.name: my-app
repository.urlrepository.url
Use a text value ##### to find code repositories by their URL.
Example
Show code repositories with this URL.
repository.url: github.com/myorg/my-app
repository.branchrepository.branch
Use a text value ##### to find code repositories by branch name.
Example
Show code repositories scanned on this branch.
repository.branch: main
code.idcode.id
Use a text value ##### to find a code asset by its unique identifier.
Example
Show the code asset with this ID.
code.id: abc123
code.commit.hashcode.commit.hash
Use a text value ##### to find code repositories by the commit hash associated with the scan.
Example
Show code repositories scanned at this commit.
code.commit.hash: a1b2c3d4e5f6
code.firstFoundDatecode.firstFoundDate
Use a date value to find code repositories by the date they were first discovered by Qualys.
Example
Show code repositories first found after this date.
code.firstFoundDate > 2025-01-01
code.lastScannedDatecode.lastScannedDate
Use a date value to find code repositories by the date of the most recent scan.
Example
Show code repositories last scanned after this date.
code.lastScannedDate > 2025-06-01
code.lastComplianceScanDatecode.lastComplianceScanDate
Use a date value to find code repositories by the date of the most recent compliance scan.
Example
Show code repositories with a compliance scan after this date.
code.lastComplianceScanDate > 2025-06-01
code.riskScorecode.riskScore
Use a numeric value to find code repositories by their TruRisk score.
Example
Show code repositories with a risk score greater than 500.
code.riskScore > 500
code.maxQdsScorecode.maxQdsScore
Use a numeric value to find code repositories by their maximum QDS score.
Example
Show code repositories with a max QDS score greater than 80.
code.maxQdsScore > 80
code.qdsSeveritycode.qdsSeverity
Use a text value ##### to find code repositories by QDS severity. Valid values are CRITICAL, HIGH, MEDIUM, and LOW.
Example
Show code repositories with a CRITICAL QDS severity.
code.qdsSeverity: CRITICAL
software.namesoftware.name
Use a text value ##### to find code repositories by the name of a software package detected through SCA.
Example
Show code repositories containing this software package.
software.name: log4j
software.versionsoftware.version
Use a text value ##### to find code repositories by the version of a software package detected through SCA.
Example
Show code repositories using this software version.
software.version: 2.14.0
software.fixVersionsoftware.fixVersion
Use a text value ##### to find code repositories by the fix version available for a software package.
Example
Show code repositories where a fix is available for this version.
software.fixVersion: 2.17.1
software.vulnerabilities.qidsoftware.vulnerabilities.qid
Use a numeric value to find code repositories that have a software package affected by this QID.
Example
Show code repositories with this vulnerability QID in a software package.
software.vulnerabilities.qid: 370917
software.vulnerabilities.titlesoftware.vulnerabilities.title
Use a text value ##### to find code repositories by the title of a software vulnerability.
Example
Show code repositories with software vulnerabilities matching this title.
software.vulnerabilities.title: Log4Shell
software.vulnerabilities.severitysoftware.vulnerabilities.severity
Use a numeric value to find code repositories by the severity of software vulnerabilities. Valid values are 1, 2, 3, 4, and 5.
Example
Show code repositories with Severity 5 software vulnerabilities.
software.vulnerabilities.severity: 5
software.vulnerabilities.typeDetectedsoftware.vulnerabilities.typeDetected
Use a text value ##### to find code repositories by the detection type of software vulnerabilities. Valid values are CONFIRMED and POTENTIAL.
Example
Show code repositories with confirmed software vulnerabilities.
software.vulnerabilities.typeDetected: CONFIRMED
software.vulnerabilities.cveidssoftware.vulnerabilities.cveids
Use a text value ##### to find code repositories by a CVE ID associated with a software vulnerability.
Example
Show code repositories with this CVE in a software package.
software.vulnerabilities.cveids: CVE-2021-44228
software.vulnerabilities.categorysoftware.vulnerabilities.category
Use a text value ##### to find code repositories by the category of a software vulnerability.
Example
Show code repositories with software vulnerabilities in this category.
software.vulnerabilities.category: CGI
software.vulnerabilities.cvssInfo.baseScoresoftware.vulnerabilities.cvssInfo.baseScore
Use a numeric value to find code repositories by the CVSS v2 base score of software vulnerabilities.
Example
Show code repositories with software vulnerabilities having a CVSS v2 base score greater than 7.
software.vulnerabilities.cvssInfo.baseScore > 7
software.vulnerabilities.cvssInfo.temporalScoresoftware.vulnerabilities.cvssInfo.temporalScore
Use a numeric value to find code repositories by the CVSS v2 temporal score of software vulnerabilities.
Example
Show code repositories with software vulnerabilities having a CVSS v2 temporal score greater than 6.
software.vulnerabilities.cvssInfo.temporalScore > 6
software.vulnerabilities.cvss3Info.baseScoresoftware.vulnerabilities.cvss3Info.baseScore
Use a numeric value to find code repositories by the CVSS v3 base score of software vulnerabilities.
Example
Show code repositories with software vulnerabilities having a CVSS v3 base score greater than 7.
software.vulnerabilities.cvss3Info.baseScore > 7
software.vulnerabilities.cvss3Info.temporalScoresoftware.vulnerabilities.cvss3Info.temporalScore
Use a numeric value to find code repositories by the CVSS v3 temporal score of software vulnerabilities.
Example
Show code repositories with software vulnerabilities having a CVSS v3 temporal score greater than 6.
software.vulnerabilities.cvss3Info.temporalScore > 6
software.vulnerabilities.risksoftware.vulnerabilities.risk
Use a numeric value to find code repositories by the risk score of software vulnerabilities.
Example
Show code repositories with software vulnerabilities having a risk score greater than 80.
software.vulnerabilities.risk > 80
software.vulnerabilities.firstFoundsoftware.vulnerabilities.firstFound
Use a date value to find code repositories by the date a software vulnerability was first detected.
Example
Show code repositories with software vulnerabilities first found after this date.
software.vulnerabilities.firstFound > 2025-01-01
software.vulnerabilities.lastFoundsoftware.vulnerabilities.lastFound
Use a date value to find code repositories by the date a software vulnerability was last detected.
Example
Show code repositories with software vulnerabilities last found after this date.
software.vulnerabilities.lastFound > 2025-06-01
software.vulnerabilities.threatIntel.activeAttackssoftware.vulnerabilities.threatIntel.activeAttacks
Use a boolean value to find code repositories with software vulnerabilities that have active attacks in the wild.
Example
Show code repositories with software vulnerabilities under active attack.
software.vulnerabilities.threatIntel.activeAttacks: true
software.vulnerabilities.threatIntel.cisaKnownExploitedVulnssoftware.vulnerabilities.threatIntel.cisaKnownExploitedVulns
Use a boolean value to find code repositories with software vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog.
Example
Show code repositories with CISA KEV software vulnerabilities.
software.vulnerabilities.threatIntel.cisaKnownExploitedVulns: true
software.vulnerabilities.threatIntel.denialOfServicesoftware.vulnerabilities.threatIntel.denialOfService
Use a boolean value to find code repositories with software vulnerabilities associated with denial of service attacks.
Example
software.vulnerabilities.threatIntel.denialOfService: true
software.vulnerabilities.threatIntel.easyExploitsoftware.vulnerabilities.threatIntel.easyExploit
Use a boolean value to find code repositories with software vulnerabilities that are easy to exploit.
Example
software.vulnerabilities.threatIntel.easyExploit: true
software.vulnerabilities.threatIntel.highDataLosssoftware.vulnerabilities.threatIntel.highDataLoss
Use a boolean value to find code repositories with software vulnerabilities associated with high data loss risk.
Example
software.vulnerabilities.threatIntel.highDataLoss: true
software.vulnerabilities.threatIntel.highLateralMovementsoftware.vulnerabilities.threatIntel.highLateralMovement
Use a boolean value to find code repositories with software vulnerabilities associated with high lateral movement risk.
Example
software.vulnerabilities.threatIntel.highLateralMovement: true
software.vulnerabilities.threatIntel.malwaresoftware.vulnerabilities.threatIntel.malware
Use a boolean value to find code repositories with software vulnerabilities associated with malware.
Example
software.vulnerabilities.threatIntel.malware: true
software.vulnerabilities.threatIntel.noPatchsoftware.vulnerabilities.threatIntel.noPatch
Use a boolean value to find code repositories with software vulnerabilities for which no patch is available.
Example
software.vulnerabilities.threatIntel.noPatch: true
software.vulnerabilities.threatIntel.predictedHighRisksoftware.vulnerabilities.threatIntel.predictedHighRisk
Use a boolean value to find code repositories with software vulnerabilities predicted to be high risk.
Example
software.vulnerabilities.threatIntel.predictedHighRisk: true
software.vulnerabilities.threatIntel.privilegeEscalationsoftware.vulnerabilities.threatIntel.privilegeEscalation
Use a boolean value to find code repositories with software vulnerabilities associated with privilege escalation.
Example
software.vulnerabilities.threatIntel.privilegeEscalation: true
software.vulnerabilities.threatIntel.publicExploitsoftware.vulnerabilities.threatIntel.publicExploit
Use a boolean value to find code repositories with software vulnerabilities that have a known public exploit.
Example
software.vulnerabilities.threatIntel.publicExploit: true
software.vulnerabilities.threatIntel.ransomwaresoftware.vulnerabilities.threatIntel.ransomware
Use a boolean value to find code repositories with software vulnerabilities associated with ransomware.
Example
software.vulnerabilities.threatIntel.ransomware: true
software.vulnerabilities.threatIntel.remoteCodeExecutionsoftware.vulnerabilities.threatIntel.remoteCodeExecution
Use a boolean value to find code repositories with software vulnerabilities that enable remote code execution.
Example
software.vulnerabilities.threatIntel.remoteCodeExecution: true
software.vulnerabilities.threatIntel.solorigateSunburstsoftware.vulnerabilities.threatIntel.solorigateSunburst
Use a boolean value to find code repositories with software vulnerabilities associated with Solorigate/Sunburst.
Example
software.vulnerabilities.threatIntel.solorigateSunburst: true
software.vulnerabilities.threatIntel.unauthenticatedExploitationsoftware.vulnerabilities.threatIntel.unauthenticatedExploitation
Use a boolean value to find code repositories with software vulnerabilities that can be exploited without authentication.
Example
software.vulnerabilities.threatIntel.unauthenticatedExploitation: true
software.vulnerabilities.threatIntel.wormablesoftware.vulnerabilities.threatIntel.wormable
Use a boolean value to find code repositories with software vulnerabilities that are wormable.
Example
software.vulnerabilities.threatIntel.wormable: true
vulnerabilities.qidvulnerabilities.qid
Use a numeric value to find code repositories by vulnerability QID.
Example
Show code repositories with this vulnerability QID.
vulnerabilities.qid: 370917
vulnerabilities.titlevulnerabilities.title
Use a text value ##### to find code repositories by vulnerability title.
Example
Show code repositories with vulnerabilities matching this title.
vulnerabilities.title: Log4Shell
vulnerabilities.severityvulnerabilities.severity
Use a numeric value to find code repositories by vulnerability severity. Valid values are 1, 2, 3, 4, and 5.
Example
Show code repositories with Severity 5 vulnerabilities.
vulnerabilities.severity: 5
vulnerabilities.typeDetectedvulnerabilities.typeDetected
Use a text value ##### to find code repositories by vulnerability detection type. Valid values are CONFIRMED and POTENTIAL.
Example
Show code repositories with confirmed vulnerabilities.
vulnerabilities.typeDetected: CONFIRMED
vulnerabilities.cveidsvulnerabilities.cveids
Use a text value ##### to find code repositories by CVE ID.
Example
Show code repositories affected by this CVE.
vulnerabilities.cveids: CVE-2021-44228
vulnerabilities.categoryvulnerabilities.category
Use a text value ##### to find code repositories by vulnerability category.
Example
Show code repositories with vulnerabilities in this category.
vulnerabilities.category: CGI
vulnerabilities.cvssInfo.baseScorevulnerabilities.cvssInfo.baseScore
Use a numeric value to find code repositories by the CVSS v2 base score of vulnerabilities.
Example
Show code repositories with a CVSS v2 base score greater than 7.
vulnerabilities.cvssInfo.baseScore > 7
vulnerabilities.cvssInfo.temporalScorevulnerabilities.cvssInfo.temporalScore
Use a numeric value to find code repositories by the CVSS v2 temporal score of vulnerabilities.
Example
Show code repositories with a CVSS v2 temporal score greater than 6.
vulnerabilities.cvssInfo.temporalScore > 6
vulnerabilities.cvss3Info.baseScorevulnerabilities.cvss3Info.baseScore
Use a numeric value to find code repositories by the CVSS v3 base score of vulnerabilities.
Example
Show code repositories with a CVSS v3 base score greater than 7.
vulnerabilities.cvss3Info.baseScore > 7
vulnerabilities.cvss3Info.temporalScorevulnerabilities.cvss3Info.temporalScore
Use a numeric value to find code repositories by the CVSS v3 temporal score of vulnerabilities.
Example
Show code repositories with a CVSS v3 temporal score greater than 6.
vulnerabilities.cvss3Info.temporalScore > 6
vulnerabilities.riskvulnerabilities.risk
Use a numeric value to find code repositories by vulnerability risk score.
Example
Show code repositories with vulnerabilities having a risk score greater than 80.
vulnerabilities.risk > 80
vulnerabilities.firstFoundvulnerabilities.firstFound
Use a date value to find code repositories by the date a vulnerability was first detected.
Example
Show code repositories with vulnerabilities first found after this date.
vulnerabilities.firstFound > 2025-01-01
vulnerabilities.lastFoundvulnerabilities.lastFound
Use a date value to find code repositories by the date a vulnerability was last detected.
Example
Show code repositories with vulnerabilities last found after this date.
vulnerabilities.lastFound > 2025-06-01
vulnerabilities.publishedvulnerabilities.published
Use a date value to find code repositories by the date a vulnerability was published by Qualys.
Example
Show code repositories with vulnerabilities published after this date.
vulnerabilities.published > 2025-01-01
vulnerabilities.vendorvulnerabilities.vendor
Use a text value ##### to find code repositories by the vendor associated with a vulnerability.
Example
Show code repositories with vulnerabilities from this vendor.
vulnerabilities.vendor: Apache
vulnerabilities.productvulnerabilities.product
Use a text value ##### to find code repositories by the product associated with a vulnerability.
Example
Show code repositories with vulnerabilities affecting this product.
vulnerabilities.product: log4j
vulnerabilities.software.namevulnerabilities.software.name
Use a text value ##### to find code repositories with vulnerabilities affecting a specific software package name.
Example
vulnerabilities.software.name: log4j
vulnerabilities.software.versionvulnerabilities.software.version
Use a text value ##### to find code repositories with vulnerabilities affecting a specific software version.
Example
vulnerabilities.software.version: 2.14.0
vulnerabilities.software.fixVersionvulnerabilities.software.fixVersion
Use a text value ##### to find code repositories with a specific fix version available for a vulnerable software package.
Example
vulnerabilities.software.fixVersion: 2.17.1
vulnerabilities.vendorData.rhsa.severityvulnerabilities.vendorData.rhsa.severity
Use a text value ##### to find code repositories by the Red Hat severity of a vulnerability.
Example
vulnerabilities.vendorData.rhsa.severity: moderate
vulnerabilities.vendorData.rhsa.idvulnerabilities.vendorData.rhsa.id
Use a text value ##### to find code repositories by Red Hat Security Advisory (RHSA) ID. Always pass the value as a string in quotes.
Example
vulnerabilities.vendorData.rhsa.id: "RHSA-2023:5476"
vulnerabilities.vendorData.rhsa.cve.severityvulnerabilities.vendorData.rhsa.cve.severity
Use a text value ##### to find code repositories by the Red Hat CVE severity within an RHSA advisory.
Example
vulnerabilities.vendorData.rhsa.cve.severity: moderate
vulnerabilities.vendorData.rhsa.cve.cvss2.baseScorevulnerabilities.vendorData.rhsa.cve.cvss2.baseScore
Use a numeric value to find code repositories by the CVSS v2 base score from Red Hat CVE data.
Example
vulnerabilities.vendorData.rhsa.cve.cvss2.baseScore > 7
vulnerabilities.vendorData.rhsa.cve.cvss3.baseScorevulnerabilities.vendorData.rhsa.cve.cvss3.baseScore
Use a numeric value to find code repositories by the CVSS v3 base score from Red Hat CVE data.
Example
vulnerabilities.vendorData.rhsa.cve.cvss3.baseScore > 7
vulnerabilities.threatIntel.activeAttacksvulnerabilities.threatIntel.activeAttacks
Use a boolean value to find code repositories with vulnerabilities that have active attacks in the wild.
Example
vulnerabilities.threatIntel.activeAttacks: true
vulnerabilities.threatIntel.cisaKnownExploitedVulnsvulnerabilities.threatIntel.cisaKnownExploitedVulns
Use a boolean value to find code repositories with vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog.
Example
vulnerabilities.threatIntel.cisaKnownExploitedVulns: true
vulnerabilities.threatIntel.denialOfServicevulnerabilities.threatIntel.denialOfService
Use a boolean value to find code repositories with vulnerabilities associated with denial of service attacks.
Example
vulnerabilities.threatIntel.denialOfService: true
vulnerabilities.threatIntel.easyExploitvulnerabilities.threatIntel.easyExploit
Use a boolean value to find code repositories with vulnerabilities that are easy to exploit.
Example
vulnerabilities.threatIntel.easyExploit: true
vulnerabilities.threatIntel.highDataLossvulnerabilities.threatIntel.highDataLoss
Use a boolean value to find code repositories with vulnerabilities associated with high data loss risk.
Example
vulnerabilities.threatIntel.highDataLoss: true
vulnerabilities.threatIntel.highLateralMovementvulnerabilities.threatIntel.highLateralMovement
Use a boolean value to find code repositories with vulnerabilities associated with high lateral movement risk.
Example
vulnerabilities.threatIntel.highLateralMovement: true
vulnerabilities.threatIntel.malwarevulnerabilities.threatIntel.malware
Use a boolean value to find code repositories with vulnerabilities associated with malware.
Example
vulnerabilities.threatIntel.malware: true
vulnerabilities.threatIntel.noPatchvulnerabilities.threatIntel.noPatch
Use a boolean value to find code repositories with vulnerabilities for which no patch is available.
Example
vulnerabilities.threatIntel.noPatch: true
vulnerabilities.threatIntel.predictedHighRiskvulnerabilities.threatIntel.predictedHighRisk
Use a boolean value to find code repositories with vulnerabilities predicted to be high risk.
Example
vulnerabilities.threatIntel.predictedHighRisk: true
vulnerabilities.threatIntel.privilegeEscalationvulnerabilities.threatIntel.privilegeEscalation
Use a boolean value to find code repositories with vulnerabilities associated with privilege escalation.
Example
vulnerabilities.threatIntel.privilegeEscalation: true
vulnerabilities.threatIntel.publicExploitvulnerabilities.threatIntel.publicExploit
Use a boolean value to find code repositories with vulnerabilities that have a known public exploit.
Example
vulnerabilities.threatIntel.publicExploit: true
vulnerabilities.threatIntel.ransomwarevulnerabilities.threatIntel.ransomware
Use a boolean value to find code repositories with vulnerabilities associated with ransomware.
Example
vulnerabilities.threatIntel.ransomware: true
vulnerabilities.threatIntel.remoteCodeExecutionvulnerabilities.threatIntel.remoteCodeExecution
Use a boolean value to find code repositories with vulnerabilities that enable remote code execution.
Example
vulnerabilities.threatIntel.remoteCodeExecution: true
vulnerabilities.threatIntel.solorigateSunburstvulnerabilities.threatIntel.solorigateSunburst
Use a boolean value to find code repositories with vulnerabilities associated with Solorigate/Sunburst.
Example
vulnerabilities.threatIntel.solorigateSunburst: true
vulnerabilities.threatIntel.unauthenticatedExploitationvulnerabilities.threatIntel.unauthenticatedExploitation
Use a boolean value to find code repositories with vulnerabilities that can be exploited without authentication.
Example
vulnerabilities.threatIntel.unauthenticatedExploitation: true
vulnerabilities.threatIntel.wormablevulnerabilities.threatIntel.wormable
Use a boolean value to find code repositories with vulnerabilities that are wormable.
Example
vulnerabilities.threatIntel.wormable: true
controls.controlIdcontrols.controlId
Use a text value ##### to find code repositories by a specific compliance control ID.
Example
Show code repositories evaluated against this control.
controls.controlId: 10826
controls.criticalitycontrols.criticality
Use a text value ##### to find code repositories by the criticality level of compliance controls. Valid values are LOW, MEDIUM, and HIGH.
Example
Show code repositories with HIGH criticality controls.
controls.criticality: HIGH
controls.posturecontrols.posture
Use a text value ##### to find code repositories by compliance posture. Valid values are PASS, FAIL, and SKIPPED.
Example
Show code repositories with failed compliance controls.
controls.posture: FAIL
andand
Use a boolean query to express your query using AND logic.
Example
Show code repositories on the main branch that have Severity 5 vulnerabilities.
repository.branch: main and vulnerabilities.severity: 5
notnot
Use a boolean query to express your query using NOT logic.
Example
Show code repositories that do not have active attacks.
not vulnerabilities.threatIntel.activeAttacks: true
oror
Use a boolean query to express your query using OR logic.
Example
Show code repositories with either ransomware or remote code execution vulnerabilities.
vulnerabilities.threatIntel.ransomware: true or vulnerabilities.threatIntel.remoteCodeExecution: true