The Code Changes feature in Vanta helps you track and review code updates across your connected repositories. This allows your team to see which changes were compliant with your security requirements and which were not—helping you stay on top of potential risks and provide clear evidence for audits. You can access this feature by selecting Assets in the navigation panel, followed by Code Changes.
Which integrations power this feature
Code Changes is powered by your connected source code management integrations, such as GitHub, GitLab, Bitbucket, and Azure DevOps. These integrations allow Vanta to monitor changes made in your repositories and display them in the Code Changes view.
Setting up Code Changes
To use Code Changes, you’ll first need to connect your code repository integrations:
From the left-hand navigation panel, select Integrations
Search for and select your source code management tool (for example, GitHub)
Follow the prompts to connect your account and authorize access
Once connected, Vanta will begin syncing recent code changes into the Code Changes page
Please note: If your Vanta package was recently upgraded to include Code Changes, the feature may take some time to populate with data.
How long until code changes appear
After setup, code changes typically appear within a few hours, depending on repository size and sync schedules. If you recently upgraded your package, it may take longer for historical changes to fully load.
Are historical changes shown
Yes. Once the integration syncs, you’ll see both recent and historical code changes in the Code Changes page—historical changes are retained for past 13 months.
What makes a code change compliant or non-compliant
Vanta evaluates each code change based on whether it meets your organization’s review and automation requirements, including:
Whether the change was approved by someone other than the author of the code change. This helps ensure that changes are independently reviewed and not self-approved.
Whether the change had an automated check associated with it. Automated checks help validate that the change meets your organization’s technical standards.
Code changes that do not meet these requirements will appear as non-compliant.