A scan runs a set of checks. Each one looks for a different kind of problem and produces findings in its own category. Which ones run is per repository and is yours to set.
The six checks
| Check | What it looks for | Category it produces | Default |
|---|---|---|---|
sast | Vulnerabilities in code you wrote, traced from untrusted input to a dangerous operation | code | On |
sca | Known vulnerabilities in the packages your manifests and lockfiles declare | dependency | On |
secrets | Credentials, keys, and tokens committed into the repository | secret | On |
iac | Unsafe settings in infrastructure and configuration files | misconfig | On |
quality | Code smells and complexity that are not vulnerabilities but make them likelier | code | Off |
sbom | A full component inventory, exportable as CycloneDX or SPDX | none | Off |
Presets
Three presets expand to sets of checks, so you do not have to name them individually.
| Preset | Expands to |
|---|---|
essentials | sast, sca, secrets |
balanced | sast, sca, secrets, iac, quality |
everything | sast, sca, secrets, iac, quality, sbom |
Changing them
cf settings
cf settings checks sast,sca,secrets
cf settings checks balanced
cf settings checks sbom --add
cf settings checks quality --remove--add and --remove change one check without restating the rest. With neither, the list you give replaces the current set.
Checks that cannot run on a repository scan
One more check is named in the product but cannot run against a repository, so setting it is refused rather than silently accepted. runtime needs an agent inside a running workload, which is not something a scan of committed code can provide.
Which ecosystems the dependency check understands
| Ecosystem | Read from |
|---|---|
| npm | package.json, package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml |
| PyPI | requirements.txt, pyproject.toml, Pipfile.lock, poetry.lock |
| Go | go.mod |
| crates.io | Cargo.toml, Cargo.lock |
| Packagist | composer.json, composer.lock |
| RubyGems | Gemfile, Gemfile.lock |
Lockfiles give the resolved versions, which is what a vulnerability lookup needs. A repository with a manifest but no lockfile still gets a dependency check, based on the declared ranges, and is correspondingly less precise.
Have a correction or need help?
Email the docs team