Configure Scan Settings for Code Assessment
Configure Code Assessment checks, automation, and remediation behavior.
Open Modules -> Code Assessment -> Run Assessment. Settings apply to the repositories selected in Scope.
Checks
Vulnerable code paths
Reviews paths from user-controlled input to security-sensitive operations.
Open-source dependency risk
Reviews manifests and lockfiles for affected packages and upgrade guidance.
Leaked secrets and credentials
Detects committed tokens, keys, credentials, and similar sensitive material.
Business logic and authorization
Reviews tenant boundaries, roles, approvals, IDOR, and unsafe state transitions.
AI inventory
Maps models, providers, prompt surfaces, and inference locations for AI-BOM output.
Enable the checks required by the review. A first baseline normally uses all available checks.
Assessment Targets
Targets are chosen per repository in Scope.
Default branch
Scans the repository default branch shown in the row.
Branch or tag
Scans the exact Git reference entered or selected.
Pull request
Scans the latest commit for the selected PR.
Commit SHA
Scans that exact commit.
The dropdown ranks live GitHub suggestions while you type. Exact branch, tag, PR, or SHA entry remains available when suggestions fail to load.
Automation
Allow manual and scheduled branch runs
Allows this wizard and saved schedules to start branch-based runs.
Run on future pull requests
Starts a scan when a PR is opened, reopened, marked ready, or updated.
Run on future push
Starts a scan for pushed commits matching the optional branch regexes.
Branch regexes
Narrows push-triggered runs to matching full branch names.
Use regular expressions such as main, release/.*, or feature/.+. With no push filter, default-branch behavior depends on the repository automation configuration shown in Review.
Auto-fix
Off
Findings include evidence and remediation guidance but no generated patch.
Suggest
Marks validated findings that are suitable for an operator-requested patch.
Auto PR
Creates a patch branch and pull request for validated findings that are safe to fix automatically.
Auto-fix does not guarantee a patch for every finding.
Submit Behavior
The final button depends on Automation:
Start run begins the selected target assessment.
Schedule run stores a one-time or recurring run.
Save automation saves PR and push rules without starting a branch run.
SBOM and AI-BOM
After a completed run, open Code Assessment -> SBOM to review inventory verification and download:
SPDX 2.3 JSON;
CycloneDX 1.6 JSON;
AI-BOM JSON.
Before Enabling Automation
Confirm the GitHub App has access to the intended repositories, branch expressions match real branch names, repository owners expect comments or pull requests, and auto-fix matches the team's change-management process.
Last updated