> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-a-code-assessment/configure-scan-settings-for-code-assessment.md).

# Configure Scan Settings for Code Assessment

Configure Code Assessment checks, automation, and remediation behavior.

Open **Modules -> Code Assessment -> Run Assessment**. Settings apply to the repositories selected in Scope.

## Checks

| Check                                | Outcome                                                                             |
| ------------------------------------ | ----------------------------------------------------------------------------------- |
| **Vulnerable code paths**            | Reviews paths from user-controlled input to security-sensitive operations.          |
| **Open-source dependency risk**      | Reviews manifests and lockfiles for affected packages and upgrade guidance.         |
| **Leaked secrets and credentials**   | Detects committed tokens, keys, credentials, and similar sensitive material.        |
| **Business logic and authorization** | Reviews tenant boundaries, roles, approvals, IDOR, and unsafe state transitions.    |
| **AI inventory**                     | Maps models, providers, prompt surfaces, and inference locations for AI-BOM output. |

Enable the checks required by the review. A first baseline normally uses all available checks.

## Assessment Targets

Targets are chosen per repository in Scope.

| Target         | Result                                                |
| -------------- | ----------------------------------------------------- |
| Default branch | Scans the repository default branch shown in the row. |
| Branch or tag  | Scans the exact Git reference entered or selected.    |
| Pull request   | Scans the latest commit for the selected PR.          |
| Commit SHA     | Scans that exact commit.                              |

The dropdown ranks live GitHub suggestions while you type. Exact branch, tag, PR, or SHA entry remains available when suggestions fail to load.

## Automation

| Option                                     | Behavior                                                               |
| ------------------------------------------ | ---------------------------------------------------------------------- |
| **Allow manual and scheduled branch runs** | Allows this wizard and saved schedules to start branch-based runs.     |
| **Run on future pull requests**            | Starts a scan when a PR is opened, reopened, marked ready, or updated. |
| **Run on future push**                     | Starts a scan for pushed commits matching the optional branch regexes. |
| **Branch regexes**                         | Narrows push-triggered runs to matching full branch names.             |

Use regular expressions such as `main`, `release/.*`, or `feature/.+`. With no push filter, default-branch behavior depends on the repository automation configuration shown in Review.

## Auto-fix

| Mode        | Behavior                                                                                           |
| ----------- | -------------------------------------------------------------------------------------------------- |
| **Off**     | Findings include evidence and remediation guidance but no generated patch.                         |
| **Suggest** | Marks validated findings that are suitable for an operator-requested patch.                        |
| **Auto PR** | Creates a patch branch and pull request for validated findings that are safe to fix automatically. |

Auto-fix does not guarantee a patch for every finding.

## Submit Behavior

The final button depends on Automation:

* **Start run** begins the selected target assessment.
* **Schedule run** stores a one-time or recurring run.
* **Save automation** saves PR and push rules without starting a branch run.

## SBOM and AI-BOM

After a completed run, open **Code Assessment -> SBOM** to review inventory verification and download:

* SPDX 2.3 JSON;
* CycloneDX 1.6 JSON;
* AI-BOM JSON.

## Before Enabling Automation

Confirm the GitHub App has access to the intended repositories, branch expressions match real branch names, repository owners expect comments or pull requests, and auto-fix matches the team's change-management process.