Skip to main content
Endor Labs automatically runs several scan types in the background to keep your findings current as new security intelligence arrives. These scans are triggered by the system and run without any configuration on your part.
  • Analytics scan: A periodic, automated scan that refreshes findings without any user action. The system runs this scan only when the analytics-check scan detects changes or new vulnerabilities. Applies only to CI and CLI-based projects. You can identify these scans in Scan history by the analytics scan type label.
  • Analytics-check scan: An automated, recurring process that checks for changes or newly introduced vulnerabilities. It skips the analytics scan if no changes are detected. Applies only to CI and CLI-based projects. You can identify these scans in Scan history by the analytics-check scan type label.
  • Finding-refresh scan: A lean scan that recomputes vulnerability findings using stored dependency metadata, without fetching source code or running a full project scan. It runs automatically after new critical vulnerability data is ingested, so findings are updated without waiting for the next scheduled scan cycle. Finding-refresh scans do not run SCA, secrets, SAST, linter, or analytics scans. They also do not update score, typosquatting, AI SAST, or security review findings. Applies to all project types, including CI, CLI, and agentless app-based projects. You can identify these scans in Scan history by the finding-refresh scan type label.
Endor Labs provides comprehensive scans to identify security issues across your software supply chain. This following sections cover the different scanning capabilities and how to configure them.

SCA (Software Composition Analysis)

Scan open source dependencies for vulnerabilities with reachability analysis.

SAST (Static Application Security Testing)

Scan your first-party code for security vulnerabilities.

GitHub Actions

Scan GitHub Actions referenced in your workflows for vulnerabilities, malware, and risky configuration.

Secrets Detection

Scan your codebase for leaked secrets and sensitive data.

Container Scanning

Scan container images for vulnerabilities and secure your deployments.

Malware detection

Scan dependencies for malware and understand how it is detected, classified, and scored.

AI Models

Scan for and govern AI models in your codebase.

OSS Licenses

Identify and manage open source license compliance.

Scan Profiles

Configure scan profiles to customize how your projects are scanned.

Pull Request scans

Scan pull requests as they are raised in your repository.

Bazel

Scan monorepos with Endor Labs using Bazel.

Working with monorepos

Scan large monorepos with strategies for performance and coverage.

RSPM (Repository Security Posture Management)

Manage repository security posture and SCM configurations.