Scan using endorctl

Scan for open source risk, SAST findings, leaked secrets, and GitHub misconfigurations using endorctl.

Use endorctl to perform comprehensive security analysis across your codebase, enabling you to detect dependency vulnerabilities, identify insecure code patterns, uncover exposed secrets, and evaluate GitHub configuration against best practices.

To run your first scan with Endor Labs, complete the following steps:

  1. Install Endor Labs on your local system
  2. Authenticate to Endor Labs
  3. Clone your repository
  4. Scan your first project

Endor Labs supports four distinct scan types to identify open source risk, code issues, leaked secrets, and configuration gaps.

Default namespace and access
When you run a scan, you can specify a namespace. If you leave it unspecified, projects are created in the root namespace of the tenant. That matters when your account or token only has access to specific namespaces. See Namespaces in Endor Labs for details.

To scan and monitor all packages in a given repository from the root of the repository, run the following command:

endorctl scan

If your project contains multiple programming languages, you can specify them as a comma-separated list using the --languages flag:

endorctl scan --languages=<languages-list>

Where <languages-list> should be provided as a comma-separated list from the supported languages: c,c#,go,java,javascript,kotlin,php,python,ruby,rust,scala,swift,typescript,swifturl.

To scan the example repository https://github.com/OWASP-Benchmark/BenchmarkJava.git, follow these steps after you authenticate to Endor Labs:

  1. Clone the repository https://github.com/OWASP-Benchmark/BenchmarkJava.git

    git clone https://github.com/OWASP-Benchmark/BenchmarkJava.git

  2. Navigate to the repository on your local system

    cd BenchmarkJava

  3. Build the repository’s package with Maven:

    mvn clean install

  4. Scan the repository

    endorctl scan

To run a SAST scan from the project root to identify potential security weaknesses in your source code, run the following command:

endorctl scan --sast

To scan a different working directory, set --path:

endorctl scan --sast --path=/path/to/code

To enable AI triage of SAST findings (Code Pro license required), add --ai-sast-analysis=agent-fallback. For prerequisites, flags, and AI analysis behavior, see Run a SAST scan.

AI-assisted SAST triage
You can enable AI-assisted triage using --ai-sast-analysis=agent-fallback. See Run a SAST scan for details.

To scan for all potentially leaked secrets in the checked out branch of your repository, run the following command:

endorctl scan --secrets

Often, secrets are leaked outside the context of your repositories main branch and can be found in older branches or those that are under active development. To identify these, Endor Labs inspects the Git logs of the repository.

To scan for all potentially leaked secrets in all branches of your repository, run the following command:

endorctl scan --secrets --git-logs

See Scan for leaked secrets for additional configuration options and workflow details.

Endor Labs allows teams to scan their repository for configuration best practices in alignment with organizational policy.

To scan the GitHub repository, you must have:

  • The GitHub repository HTTPS clone URL
  • A personal access token with access administrative access to the repository. For help creating a personal access token see GitHub documentation.

If you are on a self-hosted GitHub Enterprise Server, you should also have:

  • The GitHub API URL (This is typically the FQDN of the GitHub server)
  • A local copy of the CA Certificate if the certificate is self-signed or from a private CA

To scan a GitHub repository for misconfigurations:

  1. Export your personal access token as an environment variable:

    export GITHUB_TOKEN=<personal_access_token>

  2. Scan the repository to retrieve configuration information and analyze the configuration against organizational policy or configuration best practices:

    endorctl scan --repository-http-clone-url=https://github.com/<organization>/<repository>.git --github

For source control systems on the GitHub Enterprise Server, you must set the --github-api-url flag to your GitHub Enterprise server domain name:

endorctl scan --github-api-url=https://<fully_qualified_domain_name_to_GitHub_Enterprise_Server> --repository-http-clone-url=https://<fully_qualified_domain_name_to_GitHub_Enterprise_Server>/<organization>/<repository>.git --github