The real cost of sending your source to SaaS scanners

Nobody runs a security program for the thrill of a scan. You run it because somebody senior asked a question you could not answer, or because an auditor asked it first. So when a hosted scanner offers to find your bugs in minutes, the temptation is real, and the objections sound like the kind of caution that gets a security team ignored.

This is not an argument that hosted scanning is always wrong. It is an argument that the price is usually quoted in the wrong currency. The upload is cheap. Everything after it is not.

What actually leaves

Teams think about what they meant to send. It is worth being precise about what goes.

The source itself, which is the readable form of every decision your engineering organization has ever made — including the ones nobody documented. Configuration files, which carry hostnames, internal ports, service names, and the shape of your network. Dependencies and lockfiles, which describe your third-party inventory to anyone who can read them. And the part that catches people out: whatever was left in the repository. Old credentials that were rotated but never removed, tokens in test fixtures, an internal API key in a comment from a contract developer who left in 2021.

You did not decide to send any of that. You decided to send a directory, and the directory decided the rest.

Where it lands

Ask five questions and the answers matter more than the scanner's findings.

What is retained, and for how long. Where it is stored, and which regions. Which subprocessors can read it. Whether it is used to train anything. How deletion works, and how you would know deletion actually happened — including in backups.

Every serious vendor can answer these. The questions do not disqualify anyone; they establish what you have agreed to. Most teams have never asked them, because the decision to use a hosted scanner was made by whoever was holding the deadline, and the answers arrive in a document nobody reads until the day it matters.

The bill arrives at a different desk

Here is the cost that never shows up in the purchase order.

Your security review now has a new entry: a third party that holds a copy of your source. That entry goes into your vendor inventory, your data processing agreement, your subprocessor list, and every customer questionnaire that asks where your code lives. Your auditors will ask the same question, and the answer is no longer one line.

Then there is the version of the question nobody plans for: what you would do if that vendor were breached. Not to be dramatic about it — to be prepared, which is the job. You would need to know what they held, which of it was current, and which of your credentials were inside it. That is an incident response exercise attached to a procurement decision, and it is owned by your team.

The tool that tests your security must not become the exposure. It is the first principle of this product for a reason: it is the principle that is easiest to compromise quietly, one upload at a time.

What you would have to believe

Hosted scanning makes sense under specific conditions, and it is worth naming them so the decision is honest.

You would have to believe the retention answer, indefinitely, including after an acquisition. You would have to believe that no credential in that repository mattered. You would have to believe that the copy held elsewhere is not meaningfully easier to reach than the one inside your boundary. And you would have to believe that the questionnaire load is acceptable for the coverage you get.

Some teams can say yes to all four. Many can say yes to the first two. Almost none can say yes to the third without having thought about it for more than an afternoon.

The shape of the alternative

Running the same class of testing inside your own boundary removes the question rather than answering it. The scanner, the reasoning engine, and the results stay where the code already is. Nothing new is copied anywhere. No new subprocessor enters your inventory. The audit trail that proves what the tool did lives in your own log pipeline, and it contains references to your evidence rather than the evidence itself.

That is the whole argument, and it is not a moral one — it is a bookkeeping one. The cost of testing does not disappear, it just stops being paid by three teams who were never in the room when the decision was made.

Ask the five questions anyway. Whatever tool you choose, the answers are the part of the decision that lasts.