What Is Vulnerability Detection?

Vulnerability detection is the process of finding security weaknesses in software before an attacker can use them. It covers flaws in an application’s own code, known vulnerabilities in the open-source packages it depends on, leaked secrets, and misconfigurations in the systems it runs on.

Teams detect, rank and fix those weaknesses with a mix of automated scanners, security testing and code review.

What Changed in Vulnerability Detection in 2026

Trend: regulators put deadlines on vulnerability reporting

• The EU Cyber Resilience Act’s reporting obligations began applying on September 11, 2026, so manufacturers of products with digital elements must report actively exploited vulnerabilities, starting with an early warning within 24 hours (September 2026, EUR-Lex).

Trend: security review moves into the PR and the agent

• OpenAI’s Codex added Security Review alongside Code Review on GitHub PRs, as an early release that uses repository context and optional threat models (August 2026, OpenAI).
• Qodo added web search for current documentation and release notes of third-party dependencies, as an early feature (August 2026, Qodo’s What’s New).
• Qodo’s Agentic Toolbox reached the Claude Code, Kiro and Codex marketplaces, so its review skills can check changes before a PR opens (September 2026, Qodo’s What’s New).

Vulnerability Detection Methods

Each method looks at the software from a different angle, so teams combine several.

Code-Level Vulnerability Checks

SAST and code review look at source code before it runs. They are the earliest point to catch a vulnerability, while the developer who wrote the code still has the context to fix it.

Qodo’s page on static analysis vs AI code review compares the two, and Qodo’s comparison of AI code review tools covers which reviewers include security checks.

Dependency and Secret Scanning

SCA matches every dependency against vulnerability databases such as the National Vulnerability Database (NVD), and secret scanning looks for credentials that should never have been committed. Both catch risks that sit outside the lines a developer wrote.

Runtime Application Security Testing

DAST and IAST test the deployed or running app, so they find problems that only appear at runtime, such as a misconfigured header or an injection path through several services. They run later, which makes each finding more expensive to fix.

How Vulnerability Detection Works

1. Detect. Scanners and reviewers flag possible weaknesses in code, dependencies and configuration.
2. Prioritize. Each finding gets a severity, often from the Common Vulnerability Scoring System (CVSS), adjusted for whether the vulnerable code is reachable and exposed.
3. Fix. The owner patches the code, upgrades the package or rotates the secret.
4. Verify. A rescan or retest confirms the fix, and a regression test keeps it fixed.

Vulnerabilities Common in AI-Generated Code

AI coding tools learn from public code, so they repeat its weak patterns and add a few of their own. Several map directly to the OWASP Top 10:2025, the current edition of OWASP’s list of the most critical web application security risks.

Missing Authorization and Input Validation

Broken access control is first in the OWASP Top 10:2025, and injection is fifth. Generated endpoints often work on the happy path but skip the permission check or build a query from user input, and both look like valid code in a diff.

Hard-Coded Secrets and Weak Defaults

Agents copy placeholder keys, test tokens and outdated algorithms such as MD5 into real code, and choose permissive defaults that nobody revisits.

Invented or Outdated Dependencies

A model can suggest a package that doesn’t exist, which an attacker can then register, or pin an old version with known CVEs. OWASP now lists software supply chain failures third in its Top 10.

Error Handling That Leaks or Fails Open

A swallowed exception in an auth path can let a request through, and a verbose error can expose stack traces or internal paths. OWASP’s 2025 list adds mishandling of exceptional conditions as its tenth risk.

Qodo’s Take: Catch the Vulnerability in the PR That Introduces It

Scanners are good at known patterns, and AI-generated code often fails somewhere else: a new endpoint with no permission check, a tenant ID read straight from the request body, a retry loop that logs a token.

Those flaws read as working code, so they pass pattern checks and a tired reviewer alike. The best moment to catch them is the review of the PR that adds them, by a reviewer that knows how the rest of the codebase handles auth and data.

Qodo is that reviewer. Qodo is the best AI code review platform for vulnerability detection because it reviews each change for security issues with context from the whole codebase, next to the SAST and SCA tools a team already runs, and once Rule enforcement is on, checks the team’s security policies as rules.

Qodo Reviews Each Change for Security Issues in Context

Qodo raises Security findings for vulnerabilities in the change, such as OWASP or CWE-class issues, with examples like injection, hard-coded secrets and missing authorization checks (last checked October 2026, Qodo’s docs).

Qodo’s agents read the full codebase, so a review can see that every other endpoint in the service calls the permission helper and this one doesn’t. Qodo’s High severity group covers issues such as security or compliance violations that should be addressed before merging.

Qodo Applies the Team’s Security Policies as Rules

Security policies sit in the same rules system as coding and architecture standards. Once Rule enforcement is on in the Finding types tab, Qodo checks each PR against rules such as "all queries go through the data access layer" or "never log request bodies", and flags each violation with the rule behind it.

Qodo Review Resolver Lets the Coding Agent Fix Qodo’s Security Findings

The fix loop runs in three steps:

1. Before a PR opens, the Agentic Toolbox Reviewer skill helps catch security issues in the local diff.
2. After the PR opens, the Review Resolver skill pulls Qodo’s findings into the agent session.
3. The developer can ask it to fix the security findings only.

The people on the PR still decide what merges.

Qodo Example: A New Admin Endpoint

This illustrative scenario is a composite, not a customer case study.

A coding agent adds an endpoint that exports a customer’s invoices. Tests pass and the SAST scan is clean. Qodo’s review raises a High-severity Security finding: the handler reads the customer ID from the query string and never calls the service’s require_account_access check, which every other invoice route uses. The developer asks the agent to add the check and a test for a cross-account request.

Ways to Detect Vulnerabilities in AI-Generated Code

The table compares the tools teams combine to catch vulnerabilities in AI-written code.

Qodo features in this table were checked against Qodo’s documentation as of October 20, 2026.