> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/manage-repository-scan-configurations.md).

# Manage repository scan configurations

You can achieve granular control over repository security through scan configurations. Tailor scans by managing branches, enabling/disabling scanners, customizing PR behavior, excluding paths, and managing repository deletion.

To access repository scan configurations:

1. Select **Settings** → **Data Sources & Integrations** and search for the provider.
2. Select the relevant provider. You can see all the instances and their statuses.
3. Select an instance. The instance repositories and their statuses are displayed (including scan coverage).

   Scan coverage indicates the scan engines that run against the repository, such as IaC, SCA, and Secrets.
4. Right-click on a selected repository and select **Scan Configuration**.
5. Configure scan settings:
   * **Active Scanners**:
     * **Enable or disable Code Security scanners** (IaC, SCA, Secrets)
     * **Enable or disable Git history scans** to automatically detect secrets still present in a repository’s past commits. By identifying these exposed credentials, you can proactively address risks and prevent potential data breaches
     * **Enable/disable secrets validation** to check a detected secret’s activity status via public APIs. This allows you to prioritize and address only active, exposed secrets. Secrets validation scanning is available through the Cortex Cloud tenant and IDE extensions.
   * **PR Scanning**:
     * **Scan PR**: Enable security scans to automatically trigger on a pull request (PR) to identify potential security risks or misconfigurations before the code is merged
     * **Fail PR on scan error**: Enable pull requests (PRs) to automatically fail on a scan error. This prevents security risks and misconfigurations from being merged
   * **Tagging Bot**: Enable to automatically append a unique `yor_trace` ID to resource and module blocks when a pull request is opened. This identifier enables precise code-to-cloud tracing throughout the software development lifecycle
   * **Exclude Path**: Specify the files and directories to exclude from scanning.
     * **Exclude directories**: Enter folder names to exclude all files inside, such as `node_modules/`, `tests/`, `dist/`
     * **Exclude files by pattern**: Use wildcards: `*` for any number of characters, `?` for a single character
       * `.*.log`: Excludes all log files
       * `*.min.js` Excludes all minified JavaScript files
     * **Use a Comma-Separated List**: Separate multiple exclusions with commas. For example, `node_modules/`, `dist/, docs/`)
     * **Avoid leading slashes**: Use `dist/`, `not /dist/`
6. Click Save.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/manage-repository-scan-configurations.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.