# Security audits

Expert and Extreme run a security audit for AWS key ids, live Stripe keys, private keys, wildcard dependencies, and a missing lockfile. It is not a CVE scanner.

## What the audit matches

On Expert and Extreme, an audit run looks for AWS access key ids, Stripe live secret keys, PEM private keys, package.json dependencies pinned to * or latest, and a package.json with no lockfile beside it. Invalid package.json is reported too. The same run includes the engine diagnose.

Standard returns a plan error if you request an audit. The check is there so a hosted model is not the only thing standing between you and a pasted key.

## What it does not do

It does not query an advisory database, score container images, or replace Snyk, Dependabot, or a pentest. Treat a clean audit as 'these patterns were not found,' not as a security certification.

## Related

- [CodeSync SI vs Snyk and DeepSource](https://codesyncsi.com/compare/snyk-deepsource)
- [/pricing](https://codesyncsi.com/pricing)
- [/privacy](https://codesyncsi.com/privacy)