Scan settings | Cefense docs

cf settings covers three things: what triggers a scan, how deep each scan looks, and which analyses run when one happens. All three are per repository.

Reading the current settings

Print thembash

cf settings
cf settings --json
cf settings --agent

cf settings on its own changes nothing. It prints the repository's current trigger, its schedule when it has one, its depth, and its checks, each section showing the option in force against the ones it could be. Anything the product cannot do yet is shown and marked, rather than left off the list for you to wonder about.

The subcommands are what change something. Give one a value and it sets it. Give it none and it asks: a list to choose from for the trigger, the interval, and the depth, and a set of checkboxes for the checks, pre-ticked with what the repository has now. Choosing scheduled asks for the interval straight after.

Triggers

What starts a scanbash

cf settings mode manual
cf settings mode push
cf settings mode scheduled --every 6h
cf settings every 24h

Mode	When a scan starts
`manual`	Only when you ask
`push`	Every commit that lands on the default branch
`scheduled`	On a fixed interval, whether or not anything changed

Intervals are 1h, 6h, 12h, 24h, and 168h, and only mean anything under scheduled. See Scan triggers.

Depth

How hard each scan looksbash

cf settings depth
cf settings depth max
cf settings depth default

Depth	What it means
`default`	The full pipeline on every scan. Balanced depth and speed.
`max`	Keeps sending fresh passes until nothing new turns up. Slower, built for audits.

Depth applies from the next scan. The everyday posture is default; switch to max for an audit or a release gate, then switch back. See Scan depth.

Checks

Which analyses runbash

cf settings checks sast,sca,secrets,iac
cf settings checks balanced
cf settings checks sbom --add
cf settings checks quality --remove

Check	What it looks for
`sast`	Vulnerabilities in code you wrote
`sca`	Known vulnerabilities in your dependencies
`secrets`	Credentials committed into the repository
`iac`	Unsafe infrastructure and configuration settings
`quality`	Code smells and complexity
`sbom`	Component inventory, for export

Presets: essentials is sast, sca, secrets. balanced adds iac and quality. everything adds sbom. --add and --remove change one check without restating the rest. See Checks.

One more check is named and cannot run

runtime appears in the list, marked as unavailable. It needs an agent inside a running workload, which a scan of committed code cannot provide, so setting it is refused rather than accepted and quietly ignored.

Who can change any of this

Scan settings are an owner or admin decision. A member reading them gets the same answer everyone else does, and a member changing them gets organization_forbidden. See Organizations.

Scan triggers and scheduleThe modes in full, and what each plan includes.Scan depthDefault and max, and what the deeper one costs.Email notificationsWhat Cefense emails you about a scan, and at what severity.

Have a correction or need help?

Email the docs team