Source Code

It is a unified, continuously updated view of every code repository your organization owns or contributes to across GitHub, GitLab (cloud and self-hosted), Bitbucket (cloud and self-hosted), Azure DevOps, Codebase, SonarQube, and file-based imports. For each repository it captures the metadata that matters for security and engineering: visibility (public, private, or internal), all branches including default and protected branches, archived status, license, fork information, last commit (date, author, and message), open pull requests and issues, members and contributors with commit counts, the primary language and full language breakdown, the development tools in use, and the AI/ML frameworks detected in the code.

Repositories are part of the attack surface, yet they usually live outside the asset inventory. Without a unified view, teams cannot reliably answer basic questions such as: which repositories are publicly visible and could expose proprietary code, which projects are stale or abandoned, which open-source licenses are in use, and where AI/ML frameworks are being adopted. Source Code Inventory answers these from a single place surfacing public-exposure, license-compliance, AI-governance, and stale or unowned-repository risks without manual surveys or audits.

The platform connects to your source control providers through their APIs, and can also ingest file-based exports (CSV, JSON, XLSX, XML, SharePoint). From there it enumerates organizations, projects, repositories, branches, contributors, and configuration. No agents are deployed to developer workstations or build infrastructure, and there is no impact on commit, build, or deploy workflows.

Beyond repository metadata, Source Code Inventory automatically detects the development tools and practices in use and the AI/ML frameworks present in the code without manual surveys. Tool detection works two ways: configuration-file recognition and dependency-manifest analysis. It identifies testing, code-quality/linting, formatting, security, type-checking, CI/CD, package-management, and documentation tools. AI/ML detection through dependency analysis and Python import scanning surfaces LLM, LLM-orchestration, deep-learning, machine-learning, NLP, and image-generation frameworks, giving you an AI footprint across your codebases.

Ownership is derived from the signals the source-control platform exposes: the members with access, the contributors and their commit counts, and the author and date of the most recent commit. This makes it easy to see who is active in a repository and to identify repositories that are stale, abandoned, or without clear recent ownership.

No. SAST and SCA perform deep code-level analysis and dependency scanning. Source Code Inventory does inventory and posture work knowing every repository exists, who contributes to it, whether it is public or archived, what license and languages it uses, and which development tools and AI/ML frameworks it contains. It complements code-scanning tools, and it can ingest results from integrated tools such as SonarQube to bring code-quality and security signals alongside the rest of the inventory.

Source Code Inventory is one inventory within the unified OctoXLabs platform, alongside devices, users, software, vulnerabilities, and AI services. Repositories share the same contributor and identity context, so code activity can be related to the people behind it, and the AI/ML frameworks detected in code complement the AI Services inventory for end-to-end AI governance.