Running scans

A scan runs one or more scanners against a target and produces a deduplicated set of findings.

Basic usage

sentrasec scan .

Sentrasec inspects the target and runs every applicable scanner: source files trigger SAST and secrets detection, lockfiles trigger SCA, infrastructure definitions trigger the IaC scanner, Dockerfiles trigger container checks.

Selecting scanners

sentrasec scan . --scanners sast,secrets,sca

Available scanner identifiers:

Identifier	Scanner
sast	Static analysis
secrets	Credential detection
sca	Dependency analysis
iac	Infrastructure as code
container	Container image analysis

DAST has its own subcommand because it targets a running application rather than a path:

sentrasec dast https://staging.example.com

Findings from existing scanners (Snyk, Semgrep, SonarQube, Checkmarx, Veracode, Trivy, Qualys, Tenable, Prisma Cloud, GitHub code scanning) are imported into your workspace and triaged alongside these.

Filtering output

sentrasec scan . --severity high
sentrasec scan . --severity critical,high

Severity levels are critical, high, medium, low and info, on one scale across every scanner.

Output formats

sentrasec scan . --format text     # default, human-readable
sentrasec scan . --format json     # structured
sentrasec scan . --format sarif    # for code scanning integrations

SARIF output is what GitHub code scanning and similar systems consume.

What happens during a scan

1. Discovery: the target is inspected to determine which scanners apply.
2. Detection: applicable scanners run against the target.
3. Deduplication: detections resolving to the same location become one finding.
4. Triage: when authenticated, each finding is marked remediate or defer from application evidence, with that evidence kept.
5. Reporting: results are written in the requested format and, when authenticated, saved to the workspace.

Exit codes

Code	Meaning
0	Scan completed, no findings above the policy threshold
1	Findings above the threshold
2	Scan error

This is what makes pipeline gating work: see CI/CD integration.

Incremental scans

sentrasec scan . --since HEAD~1

Restricts analysis to files changed in a range. Useful for pull request checks where scanning the full repository on every push is wasteful.