Found in the pull request,
not in the quarterly report.
Datadog Code Security scans the libraries, the first-party code, the infrastructure files and the commits, and confirms what the running service is actually exposed to. We connect it to the repositories you choose, tune the rules until the comments are trusted, and operate it every month so each finding reaches the developer who can fix it.
Quick facts
Related
- Cloud Security, the same findings view, after the code has shipped
- App and API Protection, the attack seen in the trace and blocked in the service
- APM, the tracer the runtime scanners ride on
The finding, on the line that caused it, with the fix already drafted
A scanner report delivered to a security team is a list to be negotiated. A comment on line 48 of an open pull request, from a tool the developer already uses, is a change to be made before lunch. Code Security puts the finding in the second place, and ties it to the service in Datadog that would be affected if it shipped.
Libraries, ranked by reachability and where they run. Static scanning of lockfiles and manifests, runtime detection from the tracer. A critical advisory in a library whose vulnerable function is never called, in a service that is not in production, is scored down. One in the checkout path is scored up.
Rules on first-party code, in the editor and on the pull request. Security and quality rules run in the IDE, in CI or in Datadog's hosted scanner. Only the violations a pull request introduces are reported on it.
Vulnerabilities confirmed from traffic. Runtime Code Analysis follows real input through the running service and reports only when it reaches a vulnerable point. The finding sits next to the trace, the logs and the host.
Infrastructure files and secrets, before merge. Terraform, CloudFormation, Kubernetes, Docker and CI definitions checked on every commit. Keys and tokens found in the commit and in the history, with validity checked where Datadog supports it.
Every repository enabled, every gate blocking, and a developer who has stopped reading the comments
How it bills. The repository scanners, Static Code Analysis, Software Composition Analysis, Secret Scanning and IaC Security, are billed per committer, per month. Datadog counts a committer as an active Git author, identified by email address, who commits at least three times in the month. Runtime Code Analysis and runtime library detection are billed per host when bought on their own, and run on any host with the Datadog Agent when they come in a Code Security bundle. Either way they need the Agent and the Datadog SDK in the service. An APM subscription is not required, although APM intake is still billed for the security traces they send. Datadog publishes the bundles, meters and rates. The scope is the lever: an archived fork, a vendored mirror and a repository of generated code each produce findings nobody will act on. We decide the repository list with you before the first scan runs.
The configuration traps. Hosted scanning enabled on every repository the app can see, so the first findings page is dominated by code nobody maintains. PR Gates set to blocking on day one, before the rules have been tuned against real pull requests. The first week's merges are delayed by comments the team disputes, and the gate is switched off for good. Scanning configured both in CI and as hosted scanning, so every commit is scanned twice and the two results disagree on timing. Secret findings from Git history treated the same as findings in an open pull request, so the one live key sits in a list of four hundred dead ones. Repositories enabled without a team mapping, so the finding reaches a shared channel and stays there.
Field noteThe most common gap we see is that the scanner is connected and the pull request is not. Findings accumulate in Datadog, nobody on the development team has a reason to open Datadog, and the list is discovered during the next questionnaire.
Field noteThe first dependency scan produces a number that stops the conversation. The number is mostly transitive dependencies in services that never load them. Once runtime detection is on and reachability and production context feed the score, the list that matters is short enough to work.
Field noteBlocking gates go on before the rules have been tuned against a real pull request, and come off during the first release they delay. The pattern we keep finding is a gate that was blocking briefly and has been off since. There is no record of who turned it off or why. The finding types it was meant to stop are merging again.
Field noteHistory secrets are the finding type most often muted without being rotated. The key was committed years ago, the repository is private, and the mute is quicker than finding the owner. The key is still valid.
Repositories first. Secrets second. A gate only once the comments are trusted.
The Code Security Accelerator is a four-week, fixed-scope delivery. If Datadog is new to the estate, LaunchPad runs the platform rollout first and the accelerator follows. The order inside the accelerator does not change.
- Agree the repository list and its owners. Which repositories, which branches, which team owns each, and which of the five capabilities each repository gets. Active production code first. Archived and generated code excluded in writing.
- Connect the source host. The Datadog app installed on GitHub, GitLab or Azure DevOps with read access to the repositories in scope. Hosted scanning or CI scanning chosen per repository, never both.
- Turn on Secret Scanning before anything else. The first hosted scan covers the full Git history. Every finding marked valid is handled that week: rotate, revoke, then mute with the reason recorded.
- Enable the scanners in order. Software Composition Analysis, then Static Code Analysis, then IaC Security on the infrastructure repositories. Runtime Code Analysis is switched on in the tracer for the APM-instrumented services that take external traffic.
- Tune, then gate. Pull request comments run informational for a fortnight. Rules that produce disputed comments are narrowed or disabled per repository. PR Gates are then made blocking for the severities the team agreed, and recorded.
- Hand over, in writing. Repository list, scanner per repository, rules in force, gates and their severities. Muted findings and their reasons, the routing map, and the open findings on the day we finished.
Access is admin on the Datadog organisation plus the Datadog app on the source host with read access to the repositories in scope. We do not need write access to your code, and we do not ask for it. Suggested fixes are opened as pull requests for your developers to review.
A scanner nobody tunes becomes a comment nobody reads
New repositories appear without being enabled. A rule that was right for one service is wrong for the next. A finding accepted for ninety days is still muted a year later. Managed Observability is the monthly service that keeps the repository list, the rules and the gates matching the code as it is now.
Every month, the new findings are triaged. Against the rules in force and the mutes on file. Findings accepted for a period are re-confirmed or reopened. The rules that produced the most dismissed comments are the first ones re-tuned.
Coverage follows the repositories. New repositories are enabled and mapped to a team when they appear. Archived ones are removed from scanning. Services that gained a tracer gain runtime detection.
The gates stay honest. A gate that was switched off during a release is found in the review and either restored or formally retired with a reason. The record of which gates were blocking, and when, is kept for the questionnaire.
A live secret is an incident, not a finding. A key found valid in a commit is raised to the owner the same day, with the commit, the detector and the rotation steps attached. The finding is closed only when the rotation is confirmed.
We operate the stack. You own the product.
We are not a security company, and we do not pretend to be. We are a managed runtime operator. We run the scanning and detection tooling inside your Datadog and triage what it finds. We fix what sits in the runtime we operate and route the rest to the team that owns the code, with the evidence attached. We operate and evidence the runtime controls that support your compliance obligations. The code, the review standards and the decision to merge stay yours.
Datadog is our proof, not our headline. Datadog certified one managed provider globally. We are it. The Powered by Datadog accreditation means Datadog's own engineers reviewed how we instrument, alert, respond and report. We are also a Datadog Advanced Partner, ISO 27001 certified and Cyber Essentials Plus certified, with offices in Cardiff, London and Dublin.
Datadog Code Security, answered plainly
What is included in Datadog Code Security?
Five capabilities that share one scanner setup and one findings view. Software Composition Analysis finds vulnerable, malicious and badly licensed open source libraries, in the repository and in the running service. Static Code Analysis runs security and quality rules on first-party code. Runtime Code Analysis confirms vulnerabilities from real traffic through the APM tracer. IaC Security checks Terraform, CloudFormation, Kubernetes and similar files before they are applied. Secret Scanning finds exposed keys and tokens in commits and in Git history. Each has its own page here.
How is Datadog Code Security billed?
Code Security's repository scanners are billed per committer, per month. Datadog counts a committer as an active Git author, identified by email address, who commits at least three times in the month. Runtime Code Analysis and runtime library detection are billed per host when bought on their own, and run on any host with the Datadog Agent when they come in a Code Security bundle. Either way they need the Agent and the Datadog SDK in the service. An APM subscription is not required, although APM intake is still billed for the security traces they send. Datadog publishes the current bundles, meters and rates. We do not publish prices. We do decide, with you, which repositories are enabled, because an archived fork or a repository of generated code produces findings nobody will act on.
Will Datadog Code Security block our pull requests?
Only where you decide it should. Findings arrive as inline comments on the pull request, with a suggested fix where one exists. PR Gates are informational by default and can be made blocking per rule severity. We start informational, tune the rules against a fortnight of real pull requests, and move to blocking only for the finding types the team has agreed nobody should merge. A gate that blocks on a rule the developers do not trust gets bypassed within a week.
Is Critical Cloud a security company?
No. We are a managed runtime operator. We run the scanning and detection tooling inside your Datadog and triage what it finds. We fix what sits in the runtime we operate and route the rest to the team that owns the code, with the evidence attached. Penetration testing, secure code review as a service, security strategy and regulatory advice are not what we do. Where you have an application security team, Code Security findings reach them through the same routing.
What does Critical Cloud do with Code Security every month?
Managed Observability reviews the new findings against the rules in force. It checks that every enabled repository still has an owner and that new repositories are enabled. It re-tunes the rules that produced the most dismissed comments and expires muted findings that were accepted for a period. It reports what was found, fixed and routed. A live secret found in a commit is treated as an incident, not a finding, and the owner is told the same day.
- Datadog products: every product, and how we implement and run each one
- Software Composition Analysis, Static Code Analysis, Runtime Code Analysis, IaC Security and Secret Scanning, each on its own page
- Code Security Accelerator: repositories, scanners, rules and gates, in four weeks
Every finding on the line that caused it. Every repository with an owner.
Tell us which repositories ship to production and which languages they are in. We will show you what Code Security would find in the first week, which findings are real, and what it takes to run it.