Some or all of the information on this page might not apply to Cloud de Confiance by S3NS. See Differences from Google Cloud for more details.

Scan and verify code vulnerabilities

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms, and the Additional Terms for Generative AI Preview Products. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

Pre-GA products are in various stages of internal testing and review. As such, customers should closely supervise the use of CodeMender, and not use CodeMender in situations where serious errors cannot be corrected. This product is made available to Customers solely for limited testing and evaluation, and may not be used for commercial or production purposes.

You may only use CodeMender to analyze (i) source code that you own or are authorized to use or (ii) open source code distributed under an OSI-approved license. You must use this offering solely for legitimate security defense purposes (and not for unauthorized testing, exploitation, or cyberattacks) in compliance with the Google Cloud Acceptable Use Policy and the Generative AI Prohibited Use Policy. When using CodeMender built with a Gemini Cyber or Gemini Frontier Cyber model, your access to and use of those models is also governed by Section 31 of the Service Specific Terms.

When disabling human confirmation of write and tool execution actions (as described in the configuration file parameters), Customer is responsible for such modification under Section 20(j) ("Modifying, Disregarding, or Disabling Safety Filters") of the Service Specific Terms. The customer agrees not to automatically bypass or circumvent other responses requiring human confirmation.

CodeMender lets you proactively scan your codebase for software weaknesses and execute proof-of-concept (PoC) exploits in your local sandbox to confirm exploitability and eliminate false positives.

Scan for vulnerabilities

To scan your codebase for vulnerabilities, run cm find. By default, cm find runs a concurrent file-by-file deep scan across the target path. For a faster single-session scan, pass the --quick flag.

Scan a specific subdirectory:

cm find ./src/auth/

Run a faster single-session quick scan on a subdirectory:

cm find ./src/auth/ --quick

Scan only the modified files in a subdirectory:

cm find --diff ./src/auth/

Scan a single file:

cm find ./src/auth/session_manager.py

Skip interactive approval prompts during the scan:

cm find ./src/auth/ -y

For more information about default deep scans, scanning pull requests with --diff, or running single-session scans with --quick, see CodeMender find modes and Integrate with CI/CD.

Verify vulnerabilities

Once CodeMender identifies potential vulnerabilities, ask it to verify exploitability. During verification, CodeMender generates and executes a proof-of-concept (PoC) exploit (inside the default sandbox) to confirm whether the issue is genuinely exploitable.

Locate the finding-id from the output of cm report or cm find, then run:

cm verify FINDING_ID

Verification flags

The following flags configure cm verify:

Flag	Default	Description
`-c, --context TEXT`	`""`	Pass steering instructions or application domain context to guide the agent (for example, `cm verify FINDING_ID -c "Focus analysis on the multi-tenant session validation path"`).
`--skip-exploit-verification`	`false`	Mark high-confidence findings as verified without rerunning the PoC exploit script after the verification agent finishes. The agent still generates and runs a PoC exploit during verification.
`--sandbox`	`true`	Explicitly enable or disable the sandbox for this run (for example, `--sandbox=false` to disable).
`--unrestricted`	`false`	Temporarily bypass all sandbox protections for this run, disabling file system boundaries and OS-level container isolation.
`-y, --yes`	`false`	Skip interactive confirmation prompts (`[y/N]`) for tool actions and PoC exploit execution. Commands remain contained within the OS-level sandbox container (`exebox`).