Skip to main content
Every scope has its own automation settings. Repositories are configured on Code and cloud accounts, subscriptions and projects on Cloud, each with its own entry in the sidebar. A scope appears there once you select it on Sources. Each scope also shows its open findings by severity, which link to Findings filtered to that scope, any scan running now, and when its last full sweep ran.
Nothing is enabled or scheduled by default. No scan, schedule, CVE monitoring or pull request review starts on its own. Go through every scope you have connected and decide what should run there and how often, otherwise that scope is only ever covered by the manual scans you start yourself.

​
Repository scopes

On Code:

Scheduled scan

A full scan of the repository, daily, weekly or monthly.

Scan on push

Scans the pushed commit range. Overlapping pushes merge into one run.

Re-scan on new CVE

Free hourly monitoring. A matched CVE is analyzed when it clears your analysis threshold. See CVE disclosures.

PR reviews

A security review with inline comments on every new pull request, tracked until each issue is resolved. With it off, review a single pull request with Review now. A merge that leaves issues unresolved is recorded in Activity. See Pull request review.
Enable at least one of Scan on push or PR reviews for every active repository. On GitLab, where pull request review is not available yet, that means Scan on push. One catches a problem before it merges, the other catches what reaches your default branch. Without either, new code waits for the next scheduled scan.
Once CVE monitoring is on, Check dependencies now in a repository’s configuration reads its dependencies again and checks them for known vulnerabilities. The check runs in the background, and the configuration shows why if the repository could not be read.

​
Cloud scopes

On Cloud, accounts, subscriptions and projects support a scheduled full scan, daily, weekly or monthly, and a manual scan at any time.
PR reviews are independent of scan automation. Enabling one never enables the other. Penetration test schedules live on the Set up a pentest page, because they also carry the engagement and package to run.