Running scans
Assess a repository, follow a scan, and return to its results without confusing completion with coverage.
When to run a scanPermalink to When to run a scan
Run a scan to establish a source-security baseline, review a branch before release, or assess code after a dependency or application change. A scan records an assessment of the selected repository version; it is not a continuous statement about every later change.
Source scanning and live testing are different workflows
Before you startPermalink to Before you start
- Select the personal or organization workspace that owns the repository.
- Connect the repository and check that it is Active and eligible to scan. Resolve Disconnected, Access suspended, Archived, or Unavailable messages before retrying.
- Choose the branch or ref you intend to assess, and make sure you are authorized to scan that code.
- Check any access, availability, or scan-quota message shown by the console. A connected repository does not guarantee that a new scan can start at that moment.
Start a scanPermalink to Start a scan
Choose the repository
Open Start a scan and select the repository. Ineligible repositories show a reason rather than an available scan action.
Check Branch or ref
The repository's default branch is prefilled. Change it if you need another version, such as a release branch, before choosing Start scan.
Wait for acceptance
A successful start opens the progress view. If the request is refused, read the message and address the stated access, quota, or availability issue rather than assuming a scan was created.
Read the completed assessment
When the result is ready, check the assessed version, coverage, findings, and candidates. Complete describes the end of the run, not the security of the repository.
Follow progressPermalink to Follow progress
| Phase | What it means |
|---|---|
| Queued | The request was accepted and is waiting to begin. |
| Preparing repository | The selected code is being prepared for assessment. |
| Analyzing code | The source assessment is in progress. |
| Validating findings | Potential findings are being checked. This phase does not mean that every candidate will be confirmed. |
| Preparing report | The scan result is being prepared for review. |
A scan ends as Complete, Failed, Canceled, or Needs review. Progress is not a coverage percentage or a promise of a finish time. Read the result itself for what was assessed and what remains uncertain.
Return to a running scanPermalink to Return to a running scan
Closing the page does not cancel an accepted scan. Open the run from Scan history to follow it again. If starting a scan attaches you to an existing run for the repository, review that run's branch or ref rather than assuming a second scan was created with your new selection.
Cancel a scanPermalink to Cancel a scan
Use the cancel action while the scan is in progress, then check its resulting status. If cancellation fails, check the current state before trying again; the scan may already have finished. A canceled scan is not a completed assessment and must not be treated as a zero-finding result.
Find an earlier runPermalink to Find an earlier run
Open Scan history and search the loaded scans by repository, branch, or scan ID. Load older scans when needed. A search with no matches, or a partial-loading notice, is not evidence that the repository has never been scanned. Open a run to inspect its result or its explanation for why no result is available.