Source findings are missing
Usually the repository is not connected, the language is not analyzed, or inventory has not finished.
- Is the repository connected to this site? Source rules need it, per site.
- Has the inventory scan finished? The first one reads the tree, lockfiles, deploy files and history, and can take a while on a large repository.
- Is the code TypeScript or JavaScript? Taint analysis covers those. Other languages still get lockfile advisories, Docker, Compose, nginx, Kubernetes, Terraform and Actions.
- Is your plan a paid one? Free plans cannot connect a repository at all.
- Is the code in the repository you connected? A monorepo with the backend in another repository needs that one connected too.
Questions
My app is Python. Is AppScan useless to me?
No, but be clear about what you get: the whole runtime half, dependency advisories from lockfiles, and all the infrastructure and pipeline rules. The taint-analysis rules are TypeScript and JavaScript today.
How long does the first inventory scan take?
Minutes for a normal repository. The history walk is bounded and recorded as scanned-through, so it only happens once.
Something here wrong, missing or out of date? Tell us and we will fix the page.