CodeSync Use case
Security audits
What the audit matches
On Expert and Extreme, an audit run looks for AWS access key ids, Stripe live secret keys, PEM private keys, package.json dependencies pinned to * or latest, and a package.json with no lockfile beside it. Invalid package.json is reported too. The same run includes the engine diagnose.
Standard returns a plan error if you request an audit. The check is there so a hosted model is not the only thing standing between you and a pasted key.
What it does not do
It does not query an advisory database, score container images, or replace Snyk, Dependabot, or a pentest. Treat a clean audit as 'these patterns were not found,' not as a security certification.