Reference F: Scan configuration settings

The repository scan configuration controls which scanners run against the repository and how scanning behaves.

The scanners enabled in the repository scan configuration do not correspond one-to-one with the issue categories reported in the scan results. One scanner produces four categories, and one category is produced by a scanner that the repository scan configuration does not control. Use this mapping to relate a configuration setting to the results the setting produces.

Configured scanner	Tab and table produced	Note
IaC	Configurations > IaC Misconfigurations	Produces IaC misconfiguration detections in Terraform, CloudFormation, Kubernetes, and Helm templates.
SCA	Vulnerabilities; Package Integrity > Licenses; Package Integrity > Package Operational Risk; Malicious Packages	One scanner populates four tables across three tabs. CVE detections appear under Vulnerabilities, license miscompliance under Licenses, unmaintained and deprecated packages under Package Operational Risk, and malicious package matches under Malicious Packages.
Secrets	Secrets	Detects credentials in the working tree, and in commit history when Git History Scan is enabled.
CI/CD	Configurations > CI/CD Risks	Produced by the CI/CD scanner, which is not a setting in the repository scan configuration in Reference E: Scan configuration settings. Confirm CI/CD scanner activation on the AppSec Coverage page rather than in the repository scan configuration.

What happens when you disable the native SCA scanner?

Disabling the native SCA scanner affects risk categories differently depending on whether you use third-party vendors:

• License Miscompliance, Package Operational Risk, and Malicious Packages

  • Status: Coverage is lost entirely
  • Why: These risks are detected only by the native SCA scanner. Third-party vendor integrations drop this data, so no third-party setup can restore these categories while the native scanner is off
• Vulnerabilities (CVEs)

  • Status: Detections may still appear
  • Why: Ingested third-party findings will continue to generate CVE issues even with the native scanner disabled
  • Warning: An empty category does not mean your repository is safe, nor does a populated list mean the native scanner ran. Before interpreting your results, always confirm which scanners and third-party integrations are currently active

Recommendation: If you require full coverage (CVEs plus license, operational risk, and malicious package detection), run the native SCA scanner alongside your third-party vendor in parallel.