Security scanning
Documentation Index
Fetch the complete documentation index at: https://docs.sourcery.ai/llms.txt
Use this file to discover all available pages before exploring further.
Sourcery scans your repositories for security problems and collects everything it finds in one place. The scanners run together. You triage secrets, code vulnerabilities, misconfigurations, and dependency risk from a single view.
What gets scanned
Section titled “What gets scanned”The scanners run as one logical scan on your default branch:
- Secrets, for committed credentials and tokens.
- Static analysis (SAST), for code-level vulnerabilities.
- Infrastructure as code, for misconfigurations in Terraform, Kubernetes, and other infrastructure files.
- Dependencies and licenses, for vulnerable packages and restrictive licenses.
The scanners lists the tool behind each one and the issue type it produces.
Where findings go
Section titled “Where findings go”Every scanner writes to the same store, Issues. The workflow is the same whatever the scanner: each finding carries a severity, a status, and the same set of actions, so you snooze, ignore, or override a secret the same way you would a dependency vulnerability.
Findings and severity covers how a finding is modeled, and triage a finding walks through every action you can take on one.
When scans run
Section titled “When scans run”Scans run on a schedule that depends on your plan, against the default branch only. When scans run covers the cadence and how to queue a scan on demand.
Security scanning is a Team plan feature. Open Source and Pro include a limited preview. See plans and pricing for the plan-by-plan details.