security
May 12, 2026
By Teun
AWS Security Agent adds full repository code scanning preview
AWS has launched a preview of full repository code review in AWS Security Agent. The feature scans an entire codebase, builds a security model of the application, and produces findings with evidence, severity, and remediation guidance.
AWS has released a preview of full repository code review in AWS Security Agent, a new feature that scans an entire codebase and performs context-aware security analysis. According to AWS, the system is designed to reason about application architecture, trust boundaries, and data flows rather than only matching code against known vulnerability patterns.
The company said the feature is now available at no additional charge for AWS Security Agent customers during the preview period. AWS is also asking users to provide feedback through the Security Agent web application or by contacting their AWS account team.
⚡ New to this?
This news matters because it shows security scanners are moving beyond simple pattern checks. SAST, or static application security testing, is the kind of tool that looks for known bad code patterns; AWS says its new feature tries to understand how an entire application actually works.
That matters for non-experts because many serious bugs are not one-line mistakes. They can come from missing checks between services, inconsistent validation, or broken trust boundaries, which are the places where one part of a system assumes another part already did the security work.
🦞 OpenClaw angle
If you run self-hosted code scanning in your pipeline, compare it against repository-wide analysis rather than relying only on file-level pattern checks. Feed the scanner full repos, not just changed files, when you are reviewing inherited code or large agent frameworks with many internal calls.
For AI automation projects, pay special attention to authorization paths, data flow between tools, and places where the same input is handled differently in different modules. Use findings that include evidence and line references to update your prompts, guardrails, and code review checklists so agents do not repeat the same design flaw across multiple services.
AWS described the new capability as a way to close a gap between fast but limited static analysis tools and slow manual security reviews. Traditional static application security testing, or SAST, tools are good at spotting known patterns such as SQL injection sinks, unescaped output, or hard-coded credentials. But AWS said the most serious issues in modern applications are often systemic, such as incomplete validation logic, missing authorization checks, or inconsistent encoding across code paths.
Full repository code review is meant to inspect the entire repository, not just one file or one line. AWS said the scanner builds a security model of the application first, identifying entry points, trust boundaries, data flows, authorization invariants, and existing defenses. That profile is then used to guide deeper analysis of the most risky components.
The process runs in four stages that AWS said mirror how a security engineer would approach an engagement. First, the scanner profiles the application and maps out coverage across all source files. Then an orchestrator uses that profile to dispatch specialized agents to high-risk areas, with each agent assigned a scoped module and threat context.
After that, candidate findings are deduplicated and low-confidence noise is filtered out. Finally, an independent validator re-reads the source code and traces the attack chain, checking both why a finding might be a false alarm and why it might be real. AWS said a finding is only rejected when the evidence against it is as strong as the evidence supporting it.
According to AWS, that approach produces findings with structured “Verified” and “Could not verify” sections. The company said that gives developers a clearer view of what was confirmed in code and what still depends on deployment details such as network segmentation or runtime behavior.
AWS also said the tool is meant to surface issues that pattern matching can miss. In one example from the blog post, the scanner found a SQL injection issue by tracing a central validation function and identifying that it failed to block single quotes across five regex profiles, while another stored procedure skipped the validation function entirely. AWS said the result was a broader remediation than a single call-site fix.
In another example, AWS said the scanner identified an XSS issue where a value was inserted without HTML encoding, even though the same value was encoded elsewhere in the same file using Encode.forHtml(). The company said that kind of inconsistency is difficult for traditional tools to catch because the encoding function is present, but applied inconsistently.
AWS said the feature is designed to complement existing security tooling, not replace it. The company recommended using it before a penetration test or security review, when onboarding acquired or open source code, and during architecture reviews alongside threat models.
Full repository code review is available in preview now for AWS Security Agent customers, with AWS inviting feedback as it continues refining the feature. The company said users can enable it in the AWS Security Agent console and follow the Quickstart guide to run a first scan.
