> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/how-to-trigger-a-code-assessment/configure-scan-settings-for-code-assessment.md). # Configure Scan Settings for Code Assessment Open the settings drawer from **Modules -> Code Assessment** by selecting a repository and clicking the settings icon. Settings are saved per repository. Manual runs, schedules, and automatic scans use the saved settings for that repository. {% hint style="info" %} Automatic scans run after matching GitHub pull request or push activity. They do not scan an unpushed local working tree. {% endhint %} ## Checks Checks decide what Pentest Copilot should look for in the repository. | Check | Outcome | Use when | | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | **Vulnerable code paths** | Finds risky code paths such as user-controlled data reaching database queries, command execution, file access, SSRF, XSS, deserialization, or similar sinks. Findings include affected files, evidence, impact, and remediation guidance. | You want source-code vulnerability review similar to SAST, but with exploitability context. | | **Open-source dependency risk** | Reviews manifests and lockfiles for vulnerable packages, affected versions, CVEs, and upgrade guidance. | You need software composition analysis for third-party dependencies. | | **Leaked secrets and credentials** | Detects committed API keys, tokens, private keys, cloud credentials, and similar secrets. | You want to catch credential exposure before it reaches production or long-lived branches. | | **Business logic and authorization** | Reviews authorization boundaries and workflows for issues such as IDOR, tenant isolation gaps, role bypass, approval abuse, payment logic flaws, and unsafe state transitions. | You want deeper review of application behavior that simple pattern matching may miss. | | **Run AI Inventory with each scan** | Maps AI/LLM usage, model providers, prompt surfaces, and inference locations during each scan. | You need visibility into AI usage for governance, review, or AI-BOM export. | Enable the checks that match the review outcome you need. For a first run, keep all checks enabled so the first result set becomes a baseline. ## Automation Automation controls when the GitHub App should start scans automatically. | Option | What it does | Branch behavior | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | **Scan every pull request** | Runs when a pull request is opened, reopened, marked ready for review, or updated. Results are reported back on that pull request. | Scans the latest commit on the pull request. | | **Scan pushes** | Runs when commits are pushed to matching branches. | With no branch filter, pushes scan only the repository default branch. | | **Branch filters** | Limits push-triggered scans to specific branches or branch patterns. | Use regular expressions such as `main`, `release/.*`, or `feature/.+`. | Use pull request scans when you want feedback before merge. Use push scans when you want continuing coverage on important branches after code is merged. {% hint style="warning" %} Branch filters are regular expressions matched against the full branch name. `release/.*` matches `release/2026.07`; `release/*` is not the same pattern. {% endhint %} ## Manual Runs and Branch Selection Manual runs are started from **Modules -> Code Assessment** with **Run Code Assessment**. If you leave the branch or commit field blank, Pentest Copilot scans the repository default branch shown in the table. If you enter a branch name, tag, or commit SHA, the run uses that branch, tag, or commit instead. | Scenario | What Pentest Copilot scans | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | **Manual run, branch field blank** | The default branch shown in the repository table. | | **Manual run, branch name entered** | That branch in GitHub. | | **Manual run, commit SHA entered** | That exact commit. | | **Pull request automation** | The latest commit on the pull request. | | **Push automation** | The commit that was pushed, if the branch matches the branch filter. With no filter, only the default branch is scanned. | ## Auto-fix Auto-fix controls what happens after Pentest Copilot confirms a finding is real and safe to patch automatically. | Mode | Behavior | Use when | | ----------- | ---------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | **Off** | Pentest Copilot does not generate patches. Findings remain as evidence and remediation guidance only. | Your team wants manual remediation or is still evaluating the module. | | **Suggest** | Pentest Copilot marks confirmed findings that can be fixed automatically. A user chooses when to generate the patch. | Your team wants control before patches are created. | | **Auto PR** | After confirmation, Pentest Copilot creates a patch branch and opens a GitHub pull request against the scanned branch. | Your team wants an automated remediation workflow for safe, fixable findings. | When enabled, fix pull requests can also be commented back on the triggering pull request so reviewers can follow the remediation path from GitHub. {% hint style="warning" %} Auto-fix does not mean every finding will receive a patch. Pentest Copilot only generates fixes for findings it confirms as fixable and safe to patch automatically. {% endhint %} ## SBOM and AI-BOM Exports Open **Modules -> Code Assessment -> SBOM** after a completed assessment. This page shows the repository inventory and the **AI-BOM + SBOM verification** result. Pentest Copilot cross-checks whether the software bill of materials and AI bill of materials are internally consistent before export. The verification view helps confirm: * package totals and direct dependency totals match the collected inventory; * ecosystems are summarized consistently; * AI inference locations and AI component records are linked to evidence; * the AI file index is present when AI usage is found. Download options are shown clearly on the SBOM page: | Export | Use for | | ---------------------- | --------------------------------------------------------------------------------------------------------------- | | **SPDX 2.3 JSON** | Standards-aligned software bill of materials review, vendor requests, audit workflows, and compliance evidence. | | **CycloneDX 1.6 JSON** | Dependency governance, security tooling ingestion, and supply-chain workflows that expect CycloneDX. | | **AI-BOM JSON** | AI/LLM governance, model/provider review, prompt-surface review, and AI usage inventory. | ## Recommended Defaults | Situation | Recommended settings | | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | **First repository baseline** | Enable all checks, enable AI inventory, keep auto-fix **Off** or **Suggest**, and run the default branch manually. | | **Pull request security review** | Enable **Scan every pull request** and keep auto-fix **Suggest** until the team is comfortable with generated patches. | | **Main branch monitoring** | Enable **Scan pushes** and leave branch filters blank for default-branch-only coverage, or add filters such as `main` and `release/.*`. | | **Mature remediation workflow** | Use **Auto PR** after your team has reviewed the quality of suggested fixes on representative findings. | ## Before Enabling Automation Check: * the GitHub App has access to the intended repositories; * branch filters match the branches your team actually uses; * repository owners know where Code Assessment comments and pull requests will appear; * auto-fix mode matches your change-management process; * SBOM, CycloneDX, SPDX, and AI-BOM exports are reviewed by the right security or compliance owner.