> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Automated Scanning

> Set up continuous security scanning

Automate security scanning to catch vulnerabilities as soon as they're introduced.

## Scan Workflow Overview

CodeThreat runs scans automatically in two scenarios:

```mermaid theme={null}
graph TB
    A[Code Change] --> B{What Changed?}
    
    B -->|Pull Request| C[Deterministic Scan<br/>SAST Results]
    B -->|Push to Main| D[Deterministic Scan<br/>Full Branch]
    B -->|Full Repo Scan| E[Deterministic + Agentic SAST]
    
    C --> F[False Positive<br/>Elimination]
    C --> G[PR Review Agent]
    D --> H[False Positive<br/>Elimination]
    E --> I[False Positive<br/>Elimination]
    E --> J[Agentic SAST]
    J --> K[Repository Memory]
    J --> L[Vuln Context]
    
    F --> M[PR Comments]
    G --> M
    H --> N[Dashboard Results]
    I --> O[Comprehensive Report]
    K --> O
    L --> O
    
    style C fill:#9449FE,stroke:#6627F9,color:#fff
    style D fill:#9449FE,stroke:#6627F9,color:#fff
    style E fill:#9449FE,stroke:#6627F9,color:#fff
    style F fill:#6627F9,stroke:#9449FE,color:#fff
    style G fill:#6627F9,stroke:#9449FE,color:#fff
    style H fill:#6627F9,stroke:#9449FE,color:#fff
    style I fill:#6627F9,stroke:#9449FE,color:#fff
    style J fill:#6627F9,stroke:#9449FE,color:#fff
    style K fill:#6627F9,stroke:#9449FE,color:#fff
    style L fill:#6627F9,stroke:#9449FE,color:#fff
```

## Why Automate Scanning?

<CardGroup cols={2}>
  <Card title="Shift Left" icon="arrow-left">
    Find vulnerabilities early in development
  </Card>

  <Card title="Continuous Monitoring" icon="rotate">
    Every code change is automatically analyzed
  </Card>

  <Card title="Prevent Regressions" icon="shield-check">
    Catch reintroduced vulnerabilities immediately
  </Card>

  <Card title="No Manual Work" icon="wand-magic-sparkles">
    Scans trigger automatically
  </Card>
</CardGroup>

***

## Scan Triggers

CodeThreat automatically triggers scans based on repository events:

### On Push

Scan whenever code is pushed to tracked branches.

**Use case**: Continuous monitoring of main branches (main, develop, staging).

**Configuration**: Enable in **Repository Settings** → **Automation**

**Behavior**:

* Commit pushed → Webhook fires → Scan triggered
* Scan results appear in dashboard within minutes
* Team notified of new violations (if configured)

### On Pull Request

Scan pull requests before merging to prevent vulnerable code from entering main branches.

**Use case**: Security gate in code review process.

**Configuration**: Enable in **Repository Settings** → **Automation**

**Behavior**:

* PR created/updated → Scan triggered
* Only changed files analyzed (faster)
* Results posted as PR check
* Comments added to vulnerable lines (if enabled)

***

## Setting Up Automated Scanning

<Steps>
  <Step title="Open Repository Settings">
    **Repository** → **Settings** → **Automation**
  </Step>

  <Step title="Enable Scan Triggers">
    Toggle the scan triggers:

    * Auto-scan on push
    * Auto-scan on PR
  </Step>

  <Step title="Configure Branch Tracking">
    Add branches to monitor: main, develop, staging, release/\*
  </Step>

  <Step title="Set PR Options">
    Configure PR scanning:

    * Post PR comments
    * Block merge on failure
    * AI PR reviews
  </Step>

  <Step title="Save Configuration">
    Click **Save** to activate
  </Step>
</Steps>

***

## Webhook Health

Automated scanning relies on webhooks. Ensure webhooks are functioning:

### Verify Webhook Status

* **GitHub**: Repository → **Settings** → **Webhooks** → Check recent deliveries
* **GitLab**: Project → **Settings** → **Webhooks** → Test webhook
* **Azure DevOps**: Project → **Service hooks** → Test hook

### Troubleshooting

* Verify webhook URL is correct
* Check webhook is active in VCS settings
* Ensure repository has webhook configured
* Check firewall allows webhook connections

***

## Best Practices

* Enable on-push scanning for default branch
* Enable PR scanning for all repositories
* Monitor webhook health regularly
* Configure notifications for critical findings

***

## Next Steps

<CardGroup cols={2}>
  <Card title="PR Scanning" icon="code-pull-request" href="/scanning/pr-scanning">
    Configure PR security reviews
  </Card>

  <Card title="Webhooks" icon="webhook" href="/automation/webhooks">
    Manage webhook configuration
  </Card>
</CardGroup>