Running scans

A scan runs one or more scanners against a target and produces a deduplicated set of findings.

Basic usage

sentrasec scan .

Sentrasec inspects the target and runs every applicable scanner: source files trigger SAST and secrets detection, lockfiles trigger SCA, infrastructure definitions trigger the IaC scanner, Dockerfiles trigger container checks.

Selecting scanners

sentrasec scan . --scanners sast,secrets,sca

Available scanner identifiers:

Identifier	Scanner
sast	Static analysis
secrets	Credential detection
sca	Dependency analysis
iac	Infrastructure as code
container	Container image analysis
api	API security testing

DAST, cloud posture and Kubernetes auditing have their own subcommands because they target running systems rather than a path:

sentrasec dast https://staging.example.com
sentrasec k8s --context production

Filtering output

sentrasec scan . --severity high
sentrasec scan . --severity critical,high

Severity levels are critical, high, medium, low and info, on one scale across every scanner.

Output formats

sentrasec scan . --format text     # default, human-readable
sentrasec scan . --format json     # structured
sentrasec scan . --format sarif    # for code scanning integrations

SARIF output is what GitHub code scanning and similar systems consume.

What happens during a scan

1. Discovery: the target is inspected to determine which scanners apply.
2. Parsing: source is parsed once into syntax trees shared by every scanner that needs them.
3. Detection: applicable scanners run against the parsed representation.
4. Deduplication: detections resolving to the same code path become one finding.
5. Enrichment: if connected to Core, findings gain graph context, CVE data and exploitability.
6. Reporting: results are written in the requested format and, when authenticated, persisted to the workspace.

Steps 1–4 and 6 work offline. Step 5 is additive.

Exit codes

Code	Meaning
0	Scan completed, no findings above the policy threshold
1	Findings above the threshold
2	Scan error

This is what makes pipeline gating work: see CI/CD integration.

Incremental scans

sentrasec scan . --since HEAD~1

Restricts analysis to files changed in a range. Useful for pull request checks where scanning the full repository on every push is wasteful.