Run a scan

Every scan runs against a registered app under a key, and records which key ran it.

A scan needs two things: an app id naming what to scan, and an app key naming who is scanning. The key is not just authentication — the server records its label against the scan, so a run from CI and a run from a laptop are distinguishable months later.

Create a key under Developer Settings → API keys in the dashboard. The label you give it there is the name that will appear on every scan it runs, so name it after the thing that will use it: ci-github-actions, chetan-laptop.

Set your credentials

Pass them per command, or export them once.

$ export SENTRASEC_APP_ID=<APP-ID>$ export SENTRASEC_APP_KEY=<APP-KEY>

Run a scan

Pick a scanner with --kind.

$ sentrasec scan --kind sast --path .

The command waits for the scan to finish, then prints the findings with their file, line, CWE and finding id.

sast scan — status=complete  scan id:      17c4769a-8596-4e57-b4d9-2431d4265ba6  triggered by: key:chetan-laptop  findings:     5  [critical] SAST-TAINT-CMDI    location: app.py:19    cwe:      CWE-77    owasp:    A03:2021    id:       89f6bb84-d79b-4caf-865d-87f0d7c146f5

Run every code scanner

$ sentrasec scan --kind all

Runs SAST, SCA and secrets in sequence. It excludes DAST deliberately — DAST sends live traffic at a running system, which should be an explicit decision rather than a side effect of a convenience flag. If one scanner fails the others still run, and the failure is reported rather than folded into a clean result.

Scan a URL

$ sentrasec scan --kind dast --app-id <APP-ID>

Probes the URL stored against the app. Only scan targets you own or have written permission to test.

Gate CI on severity

$ sentrasec scan --kind all --fail-on high

Exits 3 when any finding is at or above the threshold.

Scanners

Kind	What it covers
`sast`	Static analysis of source code — injection, taint flows, unsafe APIs.
`sca`	Dependency and lockfile vulnerabilities.
`secrets`	Hardcoded credentials, tokens and keys.
`dast`	Live probing of the app's URL.
`all`	The three code scanners above, in sequence. Excludes DAST.

Read results later

A scan id is enough to re-read a scan at any time — useful after --no-wait, or in a later CI step.

$ sentrasec scan results <SCAN-ID>

Or list an app's history, including which key ran each scan.

$ sentrasec scan list

SCAN ID                                 KIND      STATUS      FOUND    TRIGGERED BY17c4769a-8596-4e57-b4d9-2431d4265ba6    sast      complete    5        key:chetan-laptop3326b5b9-0331-4a25-b34b-03aa9ba9bd59    secrets   complete    2        key:ci-github-actions

Inspect a finding

List a scan's findings, then open one in full. See the findings guide for the detail each one carries.

$ sentrasec finding list <SCAN-ID>$ sentrasec finding get <SCAN-ID> <FINDING-ID>

Options

Option	Purpose
`--app-id <ID>`	App to scan. Falls back to $SENTRASEC_APP_ID.
`--app-key <KEY>`	Key to run as. Falls back to $SENTRASEC_APP_KEY. Its label is recorded.
`--path <PATH>`	Code root for code scans. Omit to use the app's bound source.
`--ref <REF>`	Branch, tag or commit for a repo-bound app.
`--timeout <SECS>`	How long to wait for completion. Defaults to 300.
`--fail-on <SEV>`	Exit 3 when findings reach this severity. For CI.
`--format json\|text`	Output shape. Defaults to text.
`--no-wait`	Queue the scan, print its id, and return immediately.

Exit codes

Code	Meaning
`0`	Scan completed, nothing at or above the threshold.
`1`	A scan failed to run.
`2`	Usage error — a missing or unrecognised argument.
`3`	Findings reached `--fail-on`.