Your code is cloned with the network on, then egress is cut and verified with a canary before a single scanner runs. If the cut cannot be proved, the scan aborts and the credit goes back.
A scan needs the network for exactly one thing: fetching your code. After that, every additional second of connectivity is a second in which your source could leave the box. So we cut it.
The sequence is: create a sandbox, clone your repository 500 commits deep, strip the access token out of the clone's git config, then cut network egress. Only then does the first scanner run.
The part that took the longest to get right
Cutting the network is easy. Knowing that it was cut is the hard part, and it matters more than it sounds.
Every scanner we run can fetch data from the internet. If a tool tries to reach its vulnerability database, fails silently because egress is gone, and reports zero findings, that output is indistinguishable from a clean repository. A failed cut and a successful cut produce different risk; a successful cut and a partly-failed one can produce identical reports.
So we do not trust the API response that performed the cut. After cutting, the sandbox makes a request that is supposed to fail. If it succeeds, egress is still open, the scan aborts, and your credit is returned. Nothing runs until the cut is proved by observation rather than by assumption.
Everything after the cut has to work offline
This constrains the whole tool selection. The dependency check runs against a vulnerability database baked into the sandbox image, with its snapshot date printed on your report. The code analysis reads its rules from a local directory. Anything that needs to phone home is not usable here, and a couple of otherwise obvious tools were dropped for exactly that reason.
A stale database is an honest limitation and we state its date. A database that failed to load and produced no findings would not be a limitation, it would be a false pass.
And then it is destroyed
When the scanners finish, they return structured results and the sandbox is destroyed. Your source is never written to our database and never appears in a log line. Secrets we find are stored as a masked fingerprint plus a location, never the literal value — storing the key we just told you about would be worse than never finding it.