Built for buyers who cannot accept source code uploads.
CS Code separates local evidence generation from optional dashboard release history. The CLI scans locally; the dashboard receives only approved release summaries when a vendor explicitly uploads them.
Local-first CLI
Scans run on a laptop or in CI. The SaaS does not need repository access.
No source upload by default
Source files, raw SBOMs, raw vulnerability reports, changed file lists and project inventories are excluded from dashboard metadata upload.
Scoped CLI tokens
Tokens are hash-stored, expiring, revocable and scoped to upload/read permissions.
Audit logging
Important user, token, release, billing and security setting actions are tenant-scoped and visible in the dashboard.
Transport and storage
TLS is expected for production deployments. Database and object-storage encryption at rest are deployment controls for the SaaS/hosting environment.
Self-hosted path
A documented customer-local deployment path is available for Enterprise conversations where SaaS is not acceptable.
Metadata upload allowlist
What can leave the local environment?
Upload mode is explicit and token-scoped. Source code, raw scan reports, secret values, release ZIPs and full project file lists are not part of the allowlist.
Never by default
What stays out of the dashboard upload?
The CLI can generate rich local artifacts, but standard upload mode sends summaries only. The raw artifacts below remain on the customer machine by default.
Responsible disclosure
Please report suspected vulnerabilities to arran@cs-code.com. Include enough detail to reproduce the issue. Do not include classified, export-controlled or customer-sensitive source material.
SaaS data boundary
The hosted SaaS version is not intended for classified data. Organisations with restricted or sovereign hosting needs can use local packs today and evaluate the documented self-hosted deployment path.
Buyer FAQ
Short answers for security review
Do you upload my source code?
No. Standard CS Code operation scans locally and uploads metadata summaries only when you explicitly run upload mode.
Can I run locally only?
Yes. `cscode scan`, `cscode pack`, `cscode evidence`, `cscode export` and `cscode diff` work without the SaaS dashboard.
Can evidence PDFs be disabled?
Yes. Organisation security settings can block evidence PDF upload. Metadata upload continues to use the allowlist.
Is the SaaS suitable for classified data?
No. Do not put classified material into the SaaS version. Use local-only packs or discuss self-hosted/customer-local deployment.
How can I inspect uploads?
Run `cscode upload --dry-run PACK_PATH` to see the exact default fields, pack files and optional artifacts before sending anything.