Skip to main content

Scan your software with Software Composition Analysis

Use threat detection (powered by FOSSA) to scan your software for malware, vulnerabilities, secrets, and more before publicly releasing your software.

Prerequisites

  • Software Trust Manager client tools (version 1.39.0 or higher)

  • Secure your credentials

  • Add app.fossa.com to your approved list to prevent your firewall or proxy from blocking calls to FOSSA's cloud.

  • Before you run a scan, check out the source code repository

    • Before running a scan, pull or clone the code from your version control system (GitLab, GitHub, Bitbucket) into your local environment or CI/CD runner.

Install FOSSA

Create a project

Create a project to store all your related software scans, such as different versions of the same software.

You can create a project in Software Trust Manager or SMCTL:

Scan with Software Composition Analysis

To scan source code with FOSSA, use the command:

smctl scan fossa-scan --input <source code directory> --project <project alias> --scan-alias <scan alias>

Command sample:

smctl scan fossa-scan --input app/SB-Setup/test-project --version HEAD --project xyz --scan-alias scan1

Tipp

Refer to errors and solutions if you encounter an error.

View scan results

  1. In the Software Trust menu, go to Threat detection > Threat detection.

  2. Select the desired scan.

  3. Assess your threat detection results.

In diesem Abschnitt: