---
title: Security Scan
description: "Every time you save a snippet, GOCSM checks its code for patterns that often signal a security problem, and shows the results in the **Security Scan** card on the snippet's edit screen. The scan is advice. It never blocks saving…"
url: "https://brightleafdigital.io/docs/security-scan/"
updated: "2026-10-20"
category: GravityOps Code Snippet Manager / Managing Snippets
---

# Security Scan

Every time you save a snippet, GOCSM checks its code for patterns that often signal a security problem, and shows the results in the **Security Scan** card on the snippet's edit screen.

The scan is advice. It never blocks saving or activating a snippet, and a clean result does not prove that code is safe: it only means none of these patterns appeared. Review any snippet you did not write yourself, whatever the scan says.

## What the scan looks for

Each finding has a severity and, where it can be found, the line number.

| Severity | Examples |
| --- | --- |
| **High** | PHP `eval()`, `create_function()`, and shell commands such as `exec()`, `shell_exec()`, `system()` or backticks. JavaScript `eval()` and `new Function()`. Credentials written into the code, such as live Stripe keys, AWS keys, GitHub, Slack, Google or AI provider tokens, and private keys. |
| **Medium** | Functions often used to hide code, such as `base64_decode()`, `gzinflate()` and `str_rot13()`. `unserialize()`, which is unsafe on data from visitors. Including a file from a variable path. Timers given a string of code. Scripts loaded over plain `http://`. |
| **Low** | Reading `$_GET`, `$_POST` and other request data directly, as a reminder to sanitize it and check a nonce. `document.write()`. Stylesheets imported over plain `http://`. |

PHP is checked token by token, so text inside strings and comments is never reported, and method calls such as `$object->exec()` are not mistaken for the PHP function of the same name. JavaScript, CSS and HTML are checked by pattern, so a match inside a comment can be reported.

## Acting on findings

- **Credentials** — move the secret out of the snippet, into `wp-config.php` or an environment variable, and read it from there. A snippet's code is stored in the database, kept in its revision history and included in exports.
- **Code execution and shell commands** — make sure nothing a visitor sends can reach the code being run.
- **Obfuscation** — find out what the encoded content is before activating the snippet.

Developers can add their own checks, or remove findings they have reviewed, with the `gocsm_security_scan_findings` filter. See [Actions and Filters](../05-advanced/07-actions-and-filters.md).