Every connected repository has a scan mode. It decides whether Cefense ever starts a scan you did not ask for.
Repository scan modes
| Mode | When a scan starts | Use it when |
|---|---|---|
manual | Only when you ask, from the workspace or cf scan | You want full control over when scans run |
push | Every commit that lands on the default branch | You want the default branch to always have a current answer |
scheduled | On a fixed interval, whether or not anything changed | The repository moves slowly, or you care about newly published vulnerabilities in unchanged dependencies |
Pull-request source scans are a separate paid-plan trigger with partial coverage, not a fourth repository scan mode. Their scope and exclusions are described in the pull-request scanning section below.
Which triggers your plan includes
Scanning you did not ask for is a plan entitlement. Free scans when you ask and at no other time. Every paid plan adds both automatic triggers, and what separates them is how often a schedule may run.
| Plan | `manual` | `push` | `scheduled` | Shortest interval |
|---|---|---|---|---|
| Free | Yes | Not included | Not included | n/a |
| Plus | Yes | Yes | Yes | 24h |
| Pro | Yes | Yes | Yes | 6h |
| Max | Yes | Yes | Yes | 1h |
The floor is the fastest interval the plan reaches, not the only one it has: a Max repository can still be set to weekly. An interval the plan does not reach is not offered, and the workspace says which plan carries it. See Plans and billing.
Intervals
A scheduled repository scans on one of five intervals: 1h, 6h, 12h, 24h, or 168h (weekly). The interval only means anything in scheduled mode.
cf settings
cf settings mode manual
cf settings mode push
cf settings mode scheduled --every 6h
cf settings every 24hcf settings on its own prints the trigger, the schedule, the scan depth, and the checks as they stand, and changes nothing. The subcommands are what change them, and each one asks when you give it no value. See Scan settings.
What a scheduled scan skips
A repository that already has a scan queued or running when its interval comes due is skipped for that tick rather than queued behind the running one. A schedule that stacks scans is worse than a schedule that misses one.
Pull request scanning
Scanning a branch
Push and scheduled triggers act on the default branch. Any other branch is scanned by naming it, and its findings are read by naming it too.
cf branches
cf scan --branch release/2.4 --wait
cf reproduced --branch release/2.4Have a correction or need help?
Email the docs team