Skip to main content
Automate security scanning to catch vulnerabilities as soon as they’re introduced.

​
Scan Workflow Overview

CodeThreat runs scans automatically in two scenarios:

​
Why Automate Scanning?

Shift Left

Find vulnerabilities early in development

Continuous Monitoring

Every code change is automatically analyzed

Prevent Regressions

Catch reintroduced vulnerabilities immediately

No Manual Work

Scans trigger automatically

​
Scan Triggers

CodeThreat automatically triggers scans based on repository events:

​
On Push

Scan whenever code is pushed to tracked branches. Use case: Continuous monitoring of main branches (main, develop, staging). Configuration: Enable in Repository Settings → Automation Behavior:
  • Commit pushed → Webhook fires → Scan triggered
  • Scan results appear in dashboard within minutes
  • Team notified of new violations (if configured)

​
On Pull Request

Scan pull requests before merging to prevent vulnerable code from entering main branches. Use case: Security gate in code review process. Configuration: Enable in Repository Settings → Automation Behavior:
  • PR created/updated → Scan triggered
  • Only changed files analyzed (faster)
  • Results posted as PR check
  • Comments added to vulnerable lines (if enabled)

​
Setting Up Automated Scanning

1

Open Repository Settings

Repository → Settings → Automation
2

Enable Scan Triggers

Toggle the scan triggers:
  • Auto-scan on push
  • Auto-scan on PR
3

Configure Branch Tracking

Add branches to monitor: main, develop, staging, release/*
4

Set PR Options

Configure PR scanning:
  • Post PR comments
  • Block merge on failure
  • AI PR reviews
5

Save Configuration

Click Save to activate

​
Webhook Health

Automated scanning relies on webhooks. Ensure webhooks are functioning:

​
Verify Webhook Status

  • GitHub: Repository → Settings → Webhooks → Check recent deliveries
  • GitLab: Project → Settings → Webhooks → Test webhook
  • Azure DevOps: Project → Service hooks → Test hook

​
Troubleshooting

  • Verify webhook URL is correct
  • Check webhook is active in VCS settings
  • Ensure repository has webhook configured
  • Check firewall allows webhook connections

​
Best Practices

  • Enable on-push scanning for default branch
  • Enable PR scanning for all repositories
  • Monitor webhook health regularly
  • Configure notifications for critical findings

​
Next Steps

PR Scanning

Configure PR security reviews

Webhooks

Manage webhook configuration