> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scan using endorctl

> Scan for open source risk, SAST findings, leaked secrets, and GitHub misconfigurations using endorctl.

export const SupportedLanguagesList = () => {
  return <code>c,c#,go,java,javascript,kotlin,php,python,ruby,rust,scala,swift,typescript,swifturl</code>;
};

Use endorctl to perform comprehensive security analysis across your codebase, enabling you to detect dependency vulnerabilities, identify insecure code patterns, uncover exposed secrets, and evaluate GitHub configuration against best practices.

To run your first scan with Endor Labs, complete the following steps:

1. [Install Endor Labs on your local system](/setup-deployment/cli#download-and-install-endorctl)
2. [Authenticate to Endor Labs](/setup-deployment/cli#authenticate-to-endor-labs)
3. [Clone your repository](/setup-deployment/cli#clone-your-repository)
4. [Scan your first project](#run-your-first-scan)

## Run your first scan

Endor Labs supports four distinct scan types to identify open source risk, code issues, leaked secrets, and configuration gaps.

* [Scan for OSS risk](#scan-for-oss-risk)
* [Scan for SAST](#scan-for-sast)
* [Scan for leaked secrets](#scanning-for-leaked-secrets)
* [Scan for GitHub misconfigurations](#scan-for-github-misconfigurations)

<Note>
  **Default namespace and access**

  When you run a scan, you can specify a [namespace](/developers-api/cli/environment-variables#global-flags-and-variables). If you leave it unspecified, projects are created in the root namespace of the tenant. That matters when your account or token only has access to specific namespaces. See [Namespaces in Endor Labs](/platform-administration/namespaces) for details.
</Note>

### Scan for OSS risk

To scan and monitor all packages in a given repository from the root of the repository, run the following command:

```bash theme={null}
endorctl scan
```

If your project contains multiple programming languages, you can specify them as a comma-separated list using the `--languages` flag:

```bash theme={null}
endorctl scan --languages=<languages-list>

```

Where `<languages-list>` should be provided as a comma-separated list from the supported languages: <SupportedLanguagesList />.

#### Scan an example repository

To scan the example repository `https://github.com/OWASP-Benchmark/BenchmarkJava.git`, follow these steps after you [authenticate to Endor Labs](/setup-deployment/cli#authenticate-to-endor-labs):

1. Clone the repository `https://github.com/OWASP-Benchmark/BenchmarkJava.git`

   ```bash theme={null}
   git clone https://github.com/OWASP-Benchmark/BenchmarkJava.git
   ```

2. Navigate to the repository on your local system

   ```bash theme={null}
   cd BenchmarkJava
   ```

3. Build the repository’s package with Maven:

   ```bash theme={null}
   mvn clean install
   ```

4. Scan the repository

   ```bash theme={null}
   endorctl scan
   ```

### Scan for SAST

To run a SAST scan from the project root to identify potential security weaknesses in your source code, run the following command:

```bash theme={null}
endorctl scan --sast
```

To scan a different working directory, set `--path`:

```bash theme={null}
endorctl scan --sast --path=/path/to/code
```

To enable AI triage of SAST findings (Code Pro license required), add `--ai-sast-analysis=agent-fallback`. For prerequisites, flags, and AI analysis behavior, see [Run a SAST scan](/scan/sast/run-a-sast-scan).

<Note>
  **AI-assisted SAST triage**

  You can enable AI-assisted triage using `--ai-sast-analysis=agent-fallback`. See [Run a SAST scan](/scan/sast/run-a-sast-scan) for details.
</Note>

### Scanning for leaked secrets

To scan for all potentially leaked secrets in the checked out branch of your repository, run the following command:

```bash theme={null}
endorctl scan --secrets
```

Often, secrets are leaked outside the context of your repositories main branch and can be found in older branches or those that are under active development. To identify these, Endor Labs inspects the Git logs of the repository.

To scan for all potentially leaked secrets in all branches of your repository, run the following command:

```bash theme={null}
endorctl scan --secrets --git-logs
```

See [Scan for leaked secrets](/scan/secrets/scan-secrets) for additional configuration options and workflow details.

### Scan for GitHub misconfigurations

Endor Labs allows teams to scan their repository for configuration best practices in alignment with organizational policy.

#### Prerequisites

To scan the GitHub repository, you must have:

* The GitHub repository HTTPS clone URL
* A personal access token with access administrative access to the repository. For help creating a personal access token see [GitHub documentation](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens).

If you are on a self-hosted GitHub Enterprise Server, you should also have:

* The GitHub API URL (This is typically the FQDN of the GitHub server)
* A local copy of the CA Certificate if the certificate is self-signed or from a private CA

#### Run a misconfiguration scan

To scan a GitHub repository for misconfigurations:

1. Export your personal access token as an environment variable:

   ```bash theme={null}
   export GITHUB_TOKEN=<personal_access_token>
   ```

2. Scan the repository to retrieve configuration information and analyze the configuration against organizational policy or configuration best practices:

   ```bash theme={null}
   endorctl scan --repository-http-clone-url=https://github.com/<organization>/<repository>.git --github
   ```

For source control systems on the GitHub Enterprise Server, you must set the `--github-api-url` flag to your GitHub Enterprise server domain name:

```bash theme={null}
endorctl scan --github-api-url=https://<fully_qualified_domain_name_to_GitHub_Enterprise_Server> --repository-http-clone-url=https://<fully_qualified_domain_name_to_GitHub_Enterprise_Server>/<organization>/<repository>.git --github
```