Skip to main content
Select New scan to open the scan form. To scan one connected repository, you can also select Run scan on its row of the GitHub page. The form then opens on settings, with that repository as the source.

​
Step 1: source

The source step offers three tabs. For Public URL and Upload archive, you can also pick the workspace that the scan goes to.
Public URL works with public repositories only, and needs no setup. If the platform cannot read the repository, it shows We cannot read <repo>. It is private, or it does not exist. To scan a private repository, connect it first. See Connect GitHub.

​
Step 2: settings

The settings step holds these options, in this order.

​
Presets

A preset saves your agents, exclude paths, and scope under a name. Select a saved preset to apply it to this scan. To save one, set your options, then select save as preset. Enter a name under preset name, then select save. To delete a preset, select the X next to it, then confirm with Delete. Once deleted, a preset does not come back.

​
Agents

The picker groups agents by category and shows how many each one holds. You can work at either level.
  • A whole category. Select + all on a category header to add every agent in it.
  • One agent at a time. Expand a category, then select the agents you want.
Leave the field empty to run the base library, the default set.

​
Advanced

Select advanced to open these. A scope file can define:
  • Targets. What to scan.
  • Reportable. What counts as a finding.
  • Not reportable. What does not count.
  • Trust model. Who is trusted, and what an attacker controls.

​
Billed to

billed to sets how this scan is paid for. The form selects your organization’s scan mode when that mode is ready to use. An option that cannot be used shows the reason, for example Connect a provider in Billing. Only an Owner or an Admin can choose your own model. See Billing.

​
Step 3: live validation

This step is optional. Enter the URL of a running copy of your application, and the scan tests each finding against it. Leave the fields empty to skip live tests. See Live validation. Select start scan to start the scan.

​
Limits

A saved preset stores its scope file at a lower limit than one scan. A file under 1 MB can pass for a single scan and still fail to save as a preset.

​
A very large repository

One scan runs a bounded amount of work. On a very large repository the platform stops at that bound and finishes with the agents it completed. The rest are held rather than lost, and the scan page offers Continue N capped to run them and add their findings to the same scan. See Manage a scan.

​
What happens to your code

We do not keep your source code. The platform deletes your source and the working files of a scan 7 days after the scan starts. Your findings stay in the dashboard.