> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets.md). # Code Security assets **Code Security** provides a comprehensive view of assets detected by native **Infrastructure-as-Code (IaC)** and **Software Composition Analysis (SCA)** scanners. These assets are displayed in dedicated **IaC Resources** and **Software Package** inventories. Both are specialized, filtered views within the broader **All Assets** inventory. This focused approach allows you to manage and analyze your **Code Security** assets separately from other types in your environment. Code Security assets are a part of the broader Cortex Cloud Application Security asset suite, including: * **ASPM** assets, which include **Repositories**. For more information about **Repositories**, refer to [Repository as an asset](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset.md). * **Supply Chain** assets, which include **VCS Organizations**, **CI/CD Instances** and **CI/CD Pipelines**. For more information about **CI/CD Security** assets, refer to [**Supply Chain assets**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets.md). * **Identity** assets, which include **Collaborators**. For more information about **Collaborators** as assets, refer to [VCS Collaborators-as-assets](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-collaborators-as-assets.md). ### Code Security asset use cases * **Visibility and context** * **Asset inventory**: Maintain a comprehensive inventory of all detected assets, including their metadata and relationships to other assets. This provides a centralized view of all components within the environment * **Code to cloud mapping**: A graphical representation of the SDLC, highlighting the asset's location within. This visualization allows for a clear understanding of the asset's journey and its relationship to other components * **Application path to production**: Trace the asset's path through the application lifecycle, from its origin in code repositories to its deployment. This includes identifying all intermediate stages and dependencies * **Security risks** * **Infrastructure as Code** (IaC) misconfigurations: Identify misconfigurations associated with the IaC asset configuration, and provide details such as severity, location, when created and the assignee * **SCA CVE vulnerabilities**: Identify known vulnerabilities in open-source packages associated with an asset, including details such as severity, the CVE issue, CVSS score, when discovered and the assignee * **License miscompliance**: Identify and detail license miscompliance issues within packages associated with an asset, including severity, license category (such as strong copyleft), location, when discovered, and the assignee * **Package Integrity**: Identify and detail any package operational issues in packages associated with the asset, including severity, location, when created and the assignee --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-assets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.