Running a secure code review assessment using Strobes AI

Overview

A Code Review in Strobes helps identify security vulnerabilities in your application's source code. An AI agent scans the code, traces how data flows to risky operations such as database queries and file access, verifies what it finds, and provides evidence and remediation guidance to help teams address the risks. It's available in three levels: Fast, Standard, and Deep, so you can choose the right balance of speed, coverage, and assurance.

Why Is It Needed?

Security flaws in source code can reach production unnoticed and give attackers a way into your application. Reviewing your code regularly helps you find and fix vulnerabilities before they're deployed. Because the agent verifies findings before reporting them, your team spends time on genuine issues instead of scanner noise.

Available Assessment Templates

Strobes offers three Code Review templates: Fast, Standard, and Deep. All three report only confirmed findings. They differ in review depth, run time, and AI credit usage.

Code Review - Fast: A quick scan of your code that finds the most critical security issues.

Code Review - Standard: A balanced, in-depth review that finds and verifies common vulnerabilities in most applications.

Code Review - Deep: The most complete review, which adds secrets detection and business logic checks for critical applications.

Which Template Should I Choose?Which Template Should I Choose?

Prerequisites

Before you start, make sure you have:

• Access to Strobes AI Workspaces: You must have access to AI Workspaces in your organization.
• Enough AI Credits: Make sure your organization has enough AI credits for the selected template. Fast uses the fewest credits and Deep uses the most.
• Access to Your Source Code: Provide the code in one of the following ways:
• • Private Repository: A GitHub, Bitbucket, or Azure DevOps repository URL and an account with read access. You can connect your account while creating the workspace or use saved credentials.
  • Public Repository: The repository URL. No credentials are required.
  • Upload: Your codebase as a .zip, .tar.gz, .tgz, or .tar file.

Note: Strobes SAST, SCA, and secret scans run only when you provide a repository URL. If you upload your code as an archive, these scans are skipped, but the AI review still runs and reports findings.

Strobes offers different Code Review templates based on the required level of security analysis. For this guide, we will use the Standard Assessment, which provides a thorough review suitable for most applications.

1. Navigate to AI from the main navigation menu.

2. Open the Workspaces page.

3. Click New Workspace.

4. Select the Code Review - Standard template.

5. Review the template details

Selecting a template opens its details page, which shows:

• Tags: The category, number of phases, and version.
• About: What the template does.
• What to expect: How the AI agent runs the workflow. You can pause, resume, or step in at any phase.
• Outputs & deliverables: Verified security findings and a final report.
• Workflow phases: The phases the template runs, in order. For example, Code Review - Standard runs 9 phases, from repository setup and code scans to finding validation and reporting.

To continue, select Use this template. To choose a different template, select Back or Back to templates.

6. Click Use this template.

Configuring the Repository Scope

After selecting the template, the wizard automatically moves to the Scope step.

Step 1: Provide a Workspace Name

Enter a meaningful name for the assessment.

Step 2: Choose Where the Code Is

Under Where is the code?, select how Strobes should get the source code:

• Connected VCS: Review a private repository from a connected platform such as GitHub, Bitbucket, or Azure DevOps. Connect the platform or select an existing credential, then enter the Repository URL.
• Public repository: Enter the URL of a public repository. No credentials are required.
• Upload source: Upload the code as a .zip, .tar.gz, .tgz, or .tar file.

Note: If you upload the code, the Strobes SAST, SCA, and secret scans are skipped, because they can only read code from a version-control system. The AI review phases still run on the uploaded code and report findings.

Step 3: Select a Source Code Platform

If you select Connected VCS, connect GitHub, Bitbucket, or Azure DevOps, or select an existing credential from the available list.

Ensure the selected credentials have access to the repository you want to review.

Step 4: Enter the Repository URL

In the Repository URL field, enter the full URL of the repository you want to review.

• For Connected VCS, use a repository that the selected credentials can access.
• For Public repository, enter the public repository URL. No credentials are required.

The platform uses this URL to identify the repository that will be analyzed.

Step 5: Upload Source Code or Configuration Files (Optional)

If you selected Upload source, click Add file and upload your codebase as a .zip, .tar.gz, .tgz, or .tar file.

Note: SAST, SCA, and secret scans are skipped for uploaded archives, but the AI review still runs and reports findings

To upload files:

1. Click Choose Files.
2. Select the required files.
3. Wait for the upload to complete.

Step 6: Add Other Credentials (Optional)

Select additional credentials from the credential manager or click Create a new credential set to add credentials if required.

Step 7: Add Custom Instructions (Optional)

Use the Custom Instructions field to guide the assessment.

Example instructions:

• Focus on authentication bypass vulnerabilities.
• Review only API endpoints.
• Analyze payment processing workflows.
• Prioritize business logic flaws.
• Restrict testing to specific modules.

These instructions help tailor the AI analysis to specific objectives.

Step 8: Proceeding to Configuration

After completing the scope details:

1. Verify the selected repository.
2. Review uploaded files and instructions.
3. Click Next.

The wizard proceeds to the Configure step, where model, shell, and execution settings can be customized.

Step 9: Select an AI Model

The AI Model determines the Large Language Model (LLM) used during the assessment.

To select a model:

1. Open the Agent model dropdown.
2. Review the available models and their Strobes BMS scores.
3. Select the model that best fits your assessment requirements.

Strobes BMS (Benchmarking Score): Each model shows a score that rates how well it performs real security tasks, balanced against how efficiently it runs. A higher score means better overall value for security assessments.

Smart Router: If you're not sure which model to choose, select Smart Router. It automatically picks the best model for each task during the assessment.

The selected model influences:

• Analysis depth
• Reasoning capabilities
• Response quality
• Assessment speed

Step 10: Select an Agent Shell

The Shell defines the execution environment used by the AI agent.

To select a shell:

1. Open the Shell dropdown.
2. Review the available shell options.
3. Select the shell that supports your code review workflow.

The shell determines:

• Available tools
• Repository access methods
• Workflow execution capabilities
• Analysis environment

Step 11: Select a Browser

The Browser defines where the AI agent opens web pages during an assessment.

To select a browser:

1. Open the Browser dropdown.
2. Keep the default Cloud Browser.

This assessment doesn't require a browser, so no changes are needed.

Step 12: Select the Execution Mode

Choose how the AI runs the scan. Autonomous is selected by default.

• Autonomous: The AI runs all phases without pausing for approval.
• Human-in-the-loop: The AI pauses at each phase gate and waits for your approval before continuing.

Step 13: Review the Schedule

The workflow is set to One-time run by default, so it runs once.

Step 14: Click Next to Review the Configuration

Once all configuration settings have been verified:

1. Click Next.

Step 15: Continue to Review and Launch

Once all configuration settings have been verified:

1. The wizard opens the Review page.
2. Review the complete assessment configuration before launching the Code Review assessment.

Step 16: Review and Launch the Workspace

Review the configuration summary, including the playbook, workspace name, deployment, execution mode, target, phases, and agent model.

Strobes automatically checks whether the target is reachable. Once everything looks correct, click Launch workspace to start the scan.

Tips

• Repository access credentials must be configured before starting the assessment.
• The repository URL must be accessible using the selected credential.
• Uploading dependency manifests can improve dependency analysis results.
• Custom instructions are optional but can help focus the assessment on specific security concerns.
• The assessment duration varies based on repository size and complexity.