> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scan with Endor Labs

> Explore user-initiated and system-triggered scan types for vulnerabilities, secrets, license issues, malware, and more.

Endor Labs automatically runs several scan types in the background to keep your findings current as new security intelligence arrives. These scans are triggered by the system and run without any configuration on your part.

* **Analytics scan**: A periodic, automated scan that refreshes findings without any user action. The system runs this scan only when the analytics-check scan detects changes or new vulnerabilities. Applies only to CI and CLI-based projects.

  You can identify these scans in [Scan history](/inventory-insights/scan-history) by the **analytics** scan type label.

* **Analytics-check scan**: An automated, recurring process that checks for changes or newly introduced vulnerabilities. It skips the analytics scan if no changes are detected. Applies only to CI and CLI-based projects.

  You can identify these scans in [Scan history](/inventory-insights/scan-history) by the **analytics-check** scan type label.

* **Finding-refresh scan**: A lean scan that recomputes vulnerability findings using stored dependency metadata, without fetching source code or running a full project scan. It runs automatically after new critical vulnerability data is ingested, so findings are updated without waiting for the next scheduled scan cycle. Finding-refresh scans do not run SCA, secrets, SAST, linter, or analytics scans. They also do not update score, typosquatting, AI SAST, or security review findings. Applies to all project types, including CI, CLI, and agentless app-based projects.

  You can identify these scans in [Scan history](/inventory-insights/scan-history) by the **finding-refresh** scan type label.

Endor Labs provides comprehensive scans to identify security issues across your software supply chain. This following sections cover the different scanning capabilities and how to configure them.

<CardGroup cols={4}>
  <Card title="SCA (Software Composition Analysis)" icon="cube" href="/scan/sca">
    Scan open source dependencies for vulnerabilities with reachability analysis.
  </Card>

  <Card title="SAST (Static Application Security Testing)" icon="code" href="/scan/sast">
    Scan your first-party code for security vulnerabilities.
  </Card>

  <Card title="GitHub Actions" icon="github" href="/scan/github-actions">
    Scan GitHub Actions referenced in your workflows for vulnerabilities, malware, and risky configuration.
  </Card>

  <Card title="Secrets Detection" icon="key" href="/scan/secrets">
    Scan your codebase for leaked secrets and sensitive data.
  </Card>

  <Card title="Container Scanning" icon="box" href="/scan/containers">
    Scan container images for vulnerabilities and secure your deployments.
  </Card>

  <Card title="Malware detection" icon="shield-alt" href="/scan/malware">
    Scan dependencies for malware and understand how it is detected, classified, and scored.
  </Card>

  <Card title="AI Models" icon="brain" href="/scan/ai-models">
    Scan for and govern AI models in your codebase.
  </Card>

  <Card title="OSS Licenses" icon="file-contract" href="/scan/oss-licenses">
    Identify and manage open source license compliance.
  </Card>

  <Card title="Scan Profiles" icon="sliders" href="/scan/scan-profiles">
    Configure scan profiles to customize how your projects are scanned.
  </Card>

  <Card title="Pull Request scans" icon="code-branch" href="/scan/pr-scans">
    Scan pull requests as they are raised in your repository.
  </Card>

  <Card title="Bazel" icon="wrench" href="/scan/bazel">
    Scan monorepos with Endor Labs using Bazel.
  </Card>

  <Card title="Working with monorepos" icon="layer-group" href="/scan/working-with-monorepos">
    Scan large monorepos with strategies for performance and coverage.
  </Card>

  <Card title="RSPM (Repository Security Posture Management)" icon="gear" href="/scan/rspm">
    Manage repository security posture and SCM configurations.
  </Card>
</CardGroup>