Contrast Code

Contrast Code is an AI-powered orchestration engine that integrates open-source static analysis tools into the Contrast Platform. It scans your repositories for security vulnerabilities using Opengrep (SAST) and cdxgen with CycloneDX (Static SCA), then enriches those findings with AI triage and runtime context from Contrast's instrumentation sensors. The result is a prioritized, correlated view of risk from code to production without adding new agents or sensors to your existing pipeline.

Contrast Code runs as part of your GitHub CI/CD pipeline via the Contrast Security GitHub app or a GitHub Action. When a scan completes, findings are captured in the Contrast Platform as Observations. They are scored into Issues alongside any runtime data from Contrast Assess (IAST) and Contrast application detection and response (ADR). You can also view repository-to-application linkage in the Explorer, which shows which repositories map to which running applications.

Contrast Code is available as part of the Contrast Platform SKU and is licensed per active committer, which is an account that commits code to a monitored repository within any consecutive 30-day period.