> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data sent during an SCA scan

> Review the resources that endorctl sends to Endor Labs when it runs a software composition analysis scan in your CI/CD pipeline.

When you run `endorctl` in a CI/CD pipeline, the analysis happens on your build machine and only the result of that analysis goes to Endor Labs. The [Trust & Compliance](https://docs.endorlabs.com/trust-compliance.md) page describes that data by category. This page lists the resources an SCA scan sends, what each one carries, and the data that Endor Labs derives from them afterwards.

## What endorctl does on your build machine

An SCA scan performs the following work locally.

* Reads the manifest and lock files in your workspace to collect the dependencies your project declares.
* Resolves those declarations into a dependency graph, consulting your package manager, dependency caches, or build environment as needed.
* Analyzes your source code or build artifacts to construct a call graph of the functions your code defines and calls.
* Reads your Git history and `CODEOWNERS` file to attribute packages and commits.

Endor Labs receives the output of this work. Your source files, manifest and lock files, build artifacts, dependency caches, and registry credentials stay on the build machine. The one exception is code segment embeddings, which are optional and turned off by default. See [Data you control](#data-you-control) for what they send.

## Resources an SCA scan sends

The following table covers everything an SCA scan sends. Each resource links to the API reference, where you can see its full schema field by field.



  \- Resource: Project
  Data\_it\_carries: The repository name, its clone URLs, the source control platform it came from, and the namespace it belongs to
  Sent: Once, when Endor Labs first sees the repository
  API\_reference: \[ProjectService]\(/api-reference/projectservice/listprojects)
  \- Resource: Repository version
  Data\_it\_carries: The Git ref, the commit SHA, the date of the last commit, and whether the ref has been scanned
  Sent: Every scan
  API\_reference: \[RepositoryVersionService]\(/api-reference/repositoryversionservice/listrepositoryversions)
  \- Resource: Package version
  Data\_it\_carries: The package name and version, its ecosystem, language, and path in your workspace, and the dependencies it declares and resolves, with the attributes of each one
  Sent: Every scan, once per package
  API\_reference: \[PackageVersionService]\(/api-reference/packageversionservice/listpackageversions)
  \- Resource: Call graph data
  Data\_it\_carries: The types, functions, and calls in a package, recorded as identifiers, file paths, and line numbers
  Sent: Every scan, once per package with a successful call graph
  API\_reference: \[CallGraphDataService]\(/api-reference/callgraphdataservice/listcallgraphdata)
  \- Resource: Code owners
  Data\_it\_carries: The ownership patterns in your \`CODEOWNERS\` file, their owners and labels, and a hash of the file
  Sent: When the file content changes
  API\_reference: \[CodeOwnersService]\(/api-reference/codeownersservice/listcodeowners)
  \- Resource: Contributor
  Data\_it\_carries: The email address of each commit author on the scanned ref and the time they last committed
  Sent: On full scans, excluding pull request and diff-scope scans
  API\_reference: Not in the public API
  \- Resource: Scan result
  Data\_it\_carries: The status, timing, and logs of the scan, the languages and scanners it used, the operating system, hardware, and build tools of the machine it ran on, and the \`endorctl\` configuration
  Sent: Every scan
  API\_reference: \[ScanResultService]\(/api-reference/scanresultservice/listscanresults)
  \- Resource: Project summary and license summary
  Data\_it\_carries: Aggregate counts of packages, dependencies, findings, and vulnerabilities, and the SPDX license identifiers found across the project
  Sent: Every scan
  API\_reference: \[LicenseSummaryService]\(/api-reference/licensesummaryservice/listlicensesummaries)

  

### What stays on your build machine

An SCA scan reads more than it sends. The following inputs never leave the machine the scan runs on.

* **Your manifest and lock files**. Endor Labs receives only the dependency declarations that `endorctl` parses out of them.
* **The code inside your functions**. A call graph holds the identifiers, file paths, and line numbers that locate a function, not its body or source text.
* **Your API key, registry tokens, and SCM tokens**. The scan uses them on the build machine and never writes them into the scan result.

## Data Endor Labs derives from your scan

Endor Labs computes the following information based on your scans.

* **[Dependency metadata](https://docs.endorlabs.com/api-reference/dependencymetadataservice/listdependencymetadata.md)**: One record per dependency in your project, holding the dependency paths that introduce it, how it was discovered, and whether call graph analysis found it reachable.
* **[Findings](https://docs.endorlabs.com/api-reference/findingservice/listfindings.md)**: The vulnerability, license, and operational risks that Endor Labs matches against your resolved dependencies, with the location information needed to fix them.

Because this analysis runs in the cloud, Endor Labs re-evaluates your existing scan data as vulnerability and malware intelligence changes, without needing you to rescan.

## Data you control

Code segment embeddings are the one SCA capability that sends source code outside your environment. They are optional and turned off by default. When you turn them on, Endor Labs segments your source into functions and sends those segments to a private Azure OpenAI Service deployment that is isolated from the public internet and is not used for training. Endor Labs keeps only the resulting embeddings and discards the segments. The **Code Segment Embeddings and LLM Processing** setting in [data privacy settings](https://docs.endorlabs.com/platform-administration/configure-system-settings.md#configure-data-privacy-settings) controls this.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.