> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sourcery.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# The scanners

Sourcery runs these scanners over your default branch. Together they produce the issue types listed on [**Issues**](https://app.sourcery.ai/dashboard/security/issues); the [Sourcery API](/api/) refers to them by the `issue_type` codes.

| Scanner      | Tool        | What it finds                                                                | Issue type             | API `issue_type` |
| ------------ | ----------- | ---------------------------------------------------------------------------- | ---------------------- | ---------------- |
| Secrets      | BetterLeaks | Committed credentials and tokens                                             | Exposed Secrets        | `secret`         |
| SAST         | OpenGrep    | Code-level vulnerabilities                                                   | SAST                   | `sast`           |
| IaC          | Checkov     | Terraform, CloudFormation, Kubernetes, Docker, and Ansible misconfigurations | Infrastructure as Code | `iac`            |
| Dependencies | Trivy       | Vulnerable packages, including transitive paths                              | Dependencies           | `dependency`     |
| Licenses     | Trivy       | Restrictive or unknown dependency licenses                                   | Licenses               | `license`        |

## What the scanners cover

- Secrets scanning is language-agnostic. It checks the working tree and the full git history. A credential committed and later removed is still reported.
- SAST covers C, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Scala, and TypeScript.
- IaC checks Terraform, CloudFormation, Kubernetes, Docker, and Ansible files, with rules across AWS, Azure, and GCP.
- Dependency and license scanning covers the package ecosystems Trivy detects from your lockfiles, including development dependencies.

## How the tools behave

Trivy produces both the Dependencies and Licenses issue types from a single run. For a dependency finding, the dashboard renders the dependency graph. Trace a vulnerable transitive package back to the direct dependency that pulled it in.

BetterLeaks is a fork of Gitleaks and keeps its rule IDs. A secret finding's rule matches the Gitleaks rule of the same name.