Configure repository scan coverage

Scanner coverage determines what a periodic scan can detect. A scanner that is disabled produces no findings, and the absence of findings for that scanner category is indistinguishable from a clean result. Configure coverage before relying on scan results for any posture assessment.

Prerequisites: An active VCS integration with the repository onboarded, and the Data Sources (View/Edit) permission, which is required to configure repository Scan Configuration settings.

1. Navigate to Settings → Data Sources & Integrations, and search for the provider.
2. Select the provider. The provider view displays all instances and the status of each instance.
3. Select an instance. The instance view displays the connected repositories, the status of each repository, and the scan coverage of each repository. Scan coverage identifies the scan engines that run against the repository, such as IaC, SCA, and Secrets.
4. Right-click the target repository and select Scan Configuration.
5. Configure Active Scanners:

   • Enable or disable the Code Security scanners (IaC, SCA, Secrets)
   • Enable Git History Scan to detect secrets present in past commits of the repository. Detecting exposed credentials in history allows you to address the exposure proactively, because a credential deleted from the working tree remains retrievable from history until the credential is rotated
   • Enable Secrets Validation to check the activity status of a detected secret through public APIs, so that triage prioritizes active, exposed secrets over inert strings. Secrets validation is available through the Cortex Cloud tenant and the IDE extensions
6. Configure PR Scanning:

   • Scan PR: Trigger security scans automatically on a pull request, identifying security risks and misconfigurations before the code merges
   • Fail PR on scan error: Fail the pull request automatically when a scan error occurs, preventing an unscanned change from merging on the strength of a scan that did not run
   • Tagging Bot: Append a unique yor_trace identifier to resource and module blocks when a pull request opens. The yor_trace identifier enables code-to-cloud tracing across the software development lifecycle, and without the identifier the deployment-dependent Urgency signals for IaC resources cannot be computed
7. Verify the scanned branch. The scanned branch determines which code the periodic scan evaluates, and a scan of the wrong branch produces a complete-looking result for code nobody ships. To review or change the branch selection, right-click the repository and select Set Scanned Branches. For the branch selection model, see Repository as an asset.
8. Configure Exclude Path to specify the files and directories to omit from scanning:

   • Exclude directories: Enter folder names to exclude every file inside the folder, such as node_modules/, tests/, dist/
   • Exclude files by pattern: Use * for any number of characters and ? for a single character. The pattern *.log excludes all log files; the pattern *.min.js excludes all minified JavaScript files
   • Use a comma-separated list: Separate multiple exclusions with commas, such as node_modules/, dist/, docs/
   • Avoid leading slashes: Enter dist/, not /dist/
9. Select Save.

Result: The updated scan configuration applies from the next scan of the repository. Enabling a scanner that was previously disabled produces a first scan that reports the accumulated backlog for that scanner category — treat the first scan after enablement as a discovery pass, not as a regression.

Caution:

An excluded path is not scanned and produces no findings, but the scan still reports Completed and the results do not show that anything was skipped. Only exclude build artifacts and generated code (such as dist/, build/, or *.min.js). Never exclude source code to clear out security findings—use suppression instead so those risks remain tracked.

Note: For the complete scan configuration surface, see Reference F: Scan configuration settings. For each setting's scanner category, see Reference G: Scanner to issue category mapping. Scan configuration is also available programmatically — see Manage scans via public APIs.