CodeFrog
Security Testing
← Back to CodeFrog

Security Testing

Overview

CodeFrog provides comprehensive security scanning capabilities to help identify vulnerabilities, security misconfigurations, and potential security risks in your codebase.

HTTPS-First with HTTP Retry

CodeFrog uses an HTTPS-first approach for all network communications:

  1. Primary Attempt: All requests default to HTTPS
  2. Automatic Retry: If HTTPS fails, the system automatically retries with HTTP
  3. Security Warning: HTTP connections are logged with security warnings
  4. Best Practice: Always prefer HTTPS endpoints when available

This approach ensures maximum security while maintaining compatibility with legacy systems.

Skipping Sensitive File Probing

CodeFrog’s security scanner probes for exposed sensitive files and directories by requesting paths like /.git/, /.svn/, /.env, /composer.json, /package.json, /phpinfo.php, /server-status, and others. It also checks for directory listing on paths like /backup/, /logs/, and /uploads/.

The Problem: False Positives on Catch-All Sites

Some websites are configured to return a default page (HTTP 200) for any route instead of a proper 404 Not Found response. When this happens, the scanner interprets the 200 response as an exposed sensitive file, generating false positive findings marked as Critical or High severity.

For example, a site like https://example.com/.git might return the site’s homepage with a 200 status, which the scanner would flag as an exposed Git repository.

How to Skip Probing

To avoid these false positives, enable the “Skip sensitive file probing” checkbox:

When enabled, the scanner will skip all sensitive file/directory probing and directory listing checks. Other security checks (headers, CORS, TLS, cookies, etc.) will still run normally.

In the Report

When probing is skipped, the security section of the report will display an info banner noting that sensitive file probing was skipped. You can click “Re-run with probing” to generate a new report with probing enabled, or vice versa.

Secrets Detection Basics

CodeFrog integrates with Gitleaks for comprehensive secrets detection. See the Secrets / Gitleaks page for detailed information about:

Security Headers

Security headers are HTTP response headers that instruct browsers how to handle your website’s content. They provide defense-in-depth protection against common web vulnerabilities.

CodeFrog checks for the presence and proper configuration of security headers including:

Without security headers, your site relies on default browser behavior, which is often permissive and can leave you vulnerable to XSS, clickjacking, MITM attacks, and information leakage.

For detailed information about each header, what it prevents, and how to configure it, see the Security Headers: Why They Matter guide.

See also the What We Check page for a complete list of all security checks performed by CodeFrog.

TLS / Certificate Analysis

CodeFrog performs transport-layer security analysis on your target site’s TLS configuration. These checks focus on real-world security, compliance, and best practices.

Certificate Checks

Transport Checks

Protocol & CDN Detection

TLS Protocol Version Detection

CodeFrog uses native platform code (iOS: Network.framework, Android: SSLSocket) to probe which TLS protocol versions a server accepts:

Not Yet Supported

The following checks are planned for a future release:

For comprehensive cipher analysis, we recommend using SSL Labs Server Test — a free tool that performs deep TLS inspection including cipher suite enumeration and certificate chain validation.

Vulnerability Coverage

The security scanner checks for:

Common Vulnerabilities

Severity Levels

Vulnerabilities are categorized by severity:

Note: The scanner includes zero-count severities in reports, meaning if no issues are found in a category, it will still be listed as “0 Critical, 0 High, etc.” This helps verify that all categories were scanned.

Excluding Third-Party Code

By default, CodeFrog excludes common third-party directories from security scans:

This prevents false positives from dependencies you don’t control and speeds up scans.

Custom Exclusions

You can add custom exclusion patterns:

  1. Open Project Settings
  2. Navigate to Security Settings
  3. Add exclusion patterns:
    • File extensions: *.min.js, *.bundle.js
    • Directory paths: legacy/, third-party/
    • Specific files: config/old-secrets.json

Bulk Scanning

Scan First N Unscanned Files

For large codebases, you can perform incremental scans:

  1. Select “Scan First N Unscanned” option
  2. Specify the number of files (e.g., 100, 500, 1000)
  3. The scanner will:
    • Skip files already scanned in previous runs
    • Focus on new or modified files
    • Maintain a scan history database

This is useful for:

Running Security Scans

  1. Open your project in CodeFrog
  2. Navigate to the Analyze tab
  3. Select Security from analysis options
  4. Configure scan settings:
    • Choose directories to scan
    • Set exclusion patterns
    • Select severity levels to report
  5. Click Run Scan

Interpreting Results

Scan Report Structure

Acting on Results

  1. Prioritize by Severity: Start with Critical and High issues
  2. Review Context: Understand why the issue was flagged
  3. Verify False Positives: Mark legitimate false positives
  4. Plan Remediation: Create tasks or tickets for fixes
  5. Re-scan After Fixes: Verify issues are resolved

Export and Integration

Security scan results can be exported for:

Best Practices

  1. Regular Scans: Run security scans regularly, not just before launch
  2. Fix Critical Issues Immediately: Don’t delay on critical vulnerabilities
  3. Review Dependencies: Keep third-party packages updated
  4. Use HTTPS: Always prefer HTTPS endpoints
  5. Don’t Commit Secrets: Use environment variables or secure storage
  6. Review Exclusion Patterns: Ensure you’re not excluding important code