The scanners
Documentation Index
Fetch the complete documentation index at: https://docs.sourcery.ai/llms.txt
Use this file to discover all available pages before exploring further.
Sourcery runs these scanners over your default branch. Together they produce the issue types listed on Issues; the Sourcery API refers to them by the issue_type codes.
| Scanner | Tool | What it finds | Issue type | API issue_type |
|---|---|---|---|---|
| Secrets | BetterLeaks | Committed credentials and tokens | Exposed Secrets | secret |
| SAST | OpenGrep | Code-level vulnerabilities | SAST | sast |
| IaC | Checkov | Terraform, CloudFormation, Kubernetes, Docker, and Ansible misconfigurations | Infrastructure as Code | iac |
| Dependencies | Trivy | Vulnerable packages, including transitive paths | Dependencies | dependency |
| Licenses | Trivy | Restrictive or unknown dependency licenses | Licenses | license |
What the scanners cover
Section titled “What the scanners cover”- Secrets scanning is language-agnostic. It checks the working tree and the full git history. Sourcery still reports a credential that was committed and later removed.
- SAST covers C, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Scala, and TypeScript.
- IaC checks Terraform, CloudFormation, Kubernetes, Docker, and Ansible files, with rules across AWS, Azure, and GCP.
- Dependency and license scanning reads the lockfiles Trivy supports, including npm, pnpm, Yarn, pip, Poetry, uv, Go modules, Cargo, Bundler, Maven, Gradle, Composer, and NuGet. See Trivy’s language coverage for the full list. Development dependencies are included.
How the tools behave
Section titled “How the tools behave”Trivy produces both the Dependencies and Licenses issue types from a single run. For a dependency finding, the dashboard renders the dependency graph. Trace a vulnerable transitive package back to the direct dependency that pulled it in.
BetterLeaks is a fork of Gitleaks and keeps its rule IDs. A secret finding’s rule matches the Gitleaks rule of the same name.