Code Snippets can check your PHP snippets for risky patterns, such as a call to eval(), a shell command, or hard-coded credentials. When security scanning is on, each PHP snippet is scanned when you save it, and the results are shown next to the snippet. Scanning is on by default, and can be turned off in Snippets → Settings → Insights.
What a finding looks like
Each finding is rated high, medium, or low, and shows the line number, a short excerpt of the matching code, and an explanation of the risk. For example, a high-severity finding for eval() warns that any user-supplied data reaching it could lead to arbitrary code execution.
Advisory, not a blocker
Findings never block a save. A finding means “take a look at this”, not “you are not allowed to save this”. Many findings are intentional — a development snippet that runs a shell command, for example. The scan is there to make sure risky code is a decision, not an accident.
Managing findings
- Dismiss a finding once you’ve reviewed it and decided it’s fine. Dismissed findings stay dismissed when the snippet is rescanned.
- Rescan everything — the Rescan All Snippets action under Snippets → Settings → Insights runs the scan across your whole library.
Findings appear in the snippets list and in the per-snippet insights modal — see Insights on the Snippets List and Admin Bar.
This feature requires Code Snippets Pro, 4.0 or later.