Find the code behind an Airwallex payment incident

Targets the authenticated organization. Code scanning must be enabled. Read actions require code scan view permission; creating or remediating scans requires code scan use permission. Creating a profile changes the organization’s scan configuration. Updating a profile changes only fields provided; omitted fields remain unchanged. Security profile edits are submitted for user approval and do not take effect until approved; a newer suggestion for the same profile replaces the pending one. Scans use only types enabled for the organization; organizations without general scans enabled can use only security scans. Non-security scans require a profile defining their objective. Scan creation requires the user to approve the exact proposed scan setup; a request to set up a scan is not approval to launch it. Remediation launches a session that modifies code and attempts to open pull requests, and is only for findings the user explicitly asked to remediate. Incremental scans add findings to the existing scan; they are available only after a completed run and cannot start while a run is active or before the first completed run. Changing a scan’s profile affects future incremental runs only; completed runs and findings are unaffected. Profile changes cannot be applied while a run is active. Creation effort is fixed. Scans do not carry their own MCP server grants; automation-launched scans use the automation’s grants and scan settings.