CodeThreat

What is CodeThreat?

CodeThreat is an application security platform for development teams that want static analysis, dependency scanning and AI pull request review in one place. It fits small to mid-size teams on GitHub, GitLab or Bitbucket who need a first scanner without a sales call. Large regulated shops will land on the Enterprise tier and a conversation.

What it scans

The core is AI-assisted SAST that follows logic and data flow, plus SCA for dependencies. Paid tiers add secret scanning and infrastructure checks. The vendor says it supports more than 27 languages and frameworks and plugs into CI/CD pipelines.

Is the free plan enough?

The Free plan costs $0 and allows 3 private repos with SAST and SCA scanning. PR reviews and false positive filtering are limited, and there are no credit top-ups. For a side project or a two-person startup that is genuinely usable. Once you need secret scanning, Jira integration or exports, you are on Pro.

Pricing

Pro is $39 per contributor per month. Because it is billed per contributor, a ten-person team pays $390 a month, so count only the people who commit code. Enterprise adds on-prem deployment, an SLA and private LLM hosting; the price is not listed.

Who should skip it

Skip it if you need a mature compliance report library out of the box on the lower tiers; those sit in Enterprise.

Decision rule: start on Free with your most important repo, check that the findings are not noise, and move to Pro only when you need secrets or Jira.

Key features

• AI-assisted SAST
• SCA dependency scanning
• Agentic pull request reviews
• False positive filtering
• Secret scanning (Pro)
• Jira integration (Pro)
• 27+ languages claimed

Use cases

• First security scanner for a startup
• Security checks on every pull request
• Replacing noisy rule-only SAST

CodeThreat pricing

As of October 2026: Free $0/month (3 private repos); Pro $39 per contributor per month; Enterprise custom.