Skip to main content
When you run endorctl in a CI/CD pipeline, the analysis happens on your build machine and only the result of that analysis goes to Endor Labs. The Trust & Compliance page describes that data by category. This page lists the resources an SCA scan sends, what each one carries, and the data that Endor Labs derives from them afterwards.

​
What endorctl does on your build machine

An SCA scan performs the following work locally.
  • Reads the manifest and lock files in your workspace to collect the dependencies your project declares.
  • Resolves those declarations into a dependency graph, consulting your package manager, dependency caches, or build environment as needed.
  • Analyzes your source code or build artifacts to construct a call graph of the functions your code defines and calls.
  • Reads your Git history and CODEOWNERS file to attribute packages and commits.
Endor Labs receives the output of this work. Your source files, manifest and lock files, build artifacts, dependency caches, and registry credentials stay on the build machine. The one exception is code segment embeddings, which are optional and turned off by default. See Data you control for what they send.

​
Resources an SCA scan sends

The following table covers everything an SCA scan sends. Each resource links to the API reference, where you can see its full schema field by field.

​
What stays on your build machine

An SCA scan reads more than it sends. The following inputs never leave the machine the scan runs on.
  • Your manifest and lock files. Endor Labs receives only the dependency declarations that endorctl parses out of them.
  • The code inside your functions. A call graph holds the identifiers, file paths, and line numbers that locate a function, not its body or source text.
  • Your API key, registry tokens, and SCM tokens. The scan uses them on the build machine and never writes them into the scan result.

​
Data Endor Labs derives from your scan

Endor Labs computes the following information based on your scans.
  • Dependency metadata: One record per dependency in your project, holding the dependency paths that introduce it, how it was discovered, and whether call graph analysis found it reachable.
  • Findings: The vulnerability, license, and operational risks that Endor Labs matches against your resolved dependencies, with the location information needed to fix them.
Because this analysis runs in the cloud, Endor Labs re-evaluates your existing scan data as vulnerability and malware intelligence changes, without needing you to rescan.

​
Data you control

Code segment embeddings are the one SCA capability that sends source code outside your environment. They are optional and turned off by default. When you turn them on, Endor Labs segments your source into functions and sends those segments to a private Azure OpenAI Service deployment that is isolated from the public internet and is not used for training. Endor Labs keeps only the resulting embeddings and discards the segments. The Code Segment Embeddings and LLM Processing setting in data privacy settings controls this.