Security Code Scan Integration Guide

Integrate Security Code Scan with Vulnetix. Add the Roslyn analyzer to your .NET project and produce SARIF output via MSBuild.

Install & scan

$ dotnet add package SecurityCodeScan.VS2019
$ dotnet build /p:ErrorLog=security-code-scan.sarif,version=2

Run Security Code Scan in CI

Scan on every push and upload the report as a workflow artifact:

- name: Build with Security Code Scan
  run: dotnet build /p:ErrorLog=security-code-scan.sarif,version=2

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: security-code-scan
    path: security-code-scan.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Security Code Scan's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Security Code Scan. Keep running it. Vulnetix sits on top of Security Code Scan (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Security Code Scan is strongest at its core category and also carries features in Secret Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Security Code Scan does well

• Zero-config Roslyn diagnostic analyzer that runs during every dotnet build, so findings surface as compiler warnings with no separate scan step
• Inter-procedural taint analysis purpose-built for C#/VB.NET, tracking untrusted input from source to sink across methods
• Deep ASP.NET/.NET-specific OWASP coverage: SQLi, XSS, CSRF, XXE, LDAP/XPath injection, insecure deserialization, weak crypto (MD5/SHA1/DES), path traversal
• Free and open-source with configurable YAML for custom taint sources, sinks, sanitizers and validators; SARIF output and VS/NuGet/CLI deployment

Where Vulnetix adds to it: Both do SAST, but Vulnetix's built-in-rules + Semgrep engine is language-general and does not replicate Security Code Scan's Roslyn-native .NET taint depth. Better together: Vulnetix ingests SCS SARIF into one cross-scanner deduplicated queue and layers what SCS lacks entirely - EPSS/KEV/LEV exploit-intel prioritisation, reachability, versioned VEX + audit, Safe Harbour autofix, EOL and SSVC policy.

No migration, no rip-and-replace. Security Code Scan keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Security Code Scan results in Vulnetix

Upload Security Code Scan SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Security Code Scan documentation ↗  ·  Source repository ↗

Wire Security Code Scan into your CI/CD pipeline →