Kinds of scan
Free runtime, manual runtime, source inventory, source change, pull request, history and advisory review - what triggers each.
| Kind | Triggered by | What it runs |
|---|---|---|
| FREE_RUNTIME | The landing page form | Live-site rules and a one-page browser recording. |
| MANUAL_RUNTIME | Scan now on a site | The full runtime pass across discovered routes. |
| SOURCE_INVENTORY | Connecting a repository | Tree, lockfiles, deploy files and a bounded history walk. |
| SOURCE_CHANGE | A push, coalesced into a change set | Source, secret and infrastructure rules over what changed. |
| PULL_REQUEST | Opening or updating a pull request | The same rules, compared against the base branch. |
| SOURCE_HISTORY | After inventory, once | Git history for credentials that were removed but never rotated. |
| ADVISORY_REVIEW | A new advisory landing | Re-evaluation of affected applications, daily. |
Tiers
A scan is either FREE or PRO tier. The tier decides how much work it is allowed to do: how many routes the browser pass walks, how deep discovery goes, and whether source stages run at all.
Questions
What is the difference between “scan now” and continuous monitoring?
Scan now is a manual live-site scan you trigger. It is free and unlimited on paid plans (one at a time per site, with a short cooldown); the Free plan includes five a month at one credit each. Continuous monitoring is the automatic work that follows pushes, pull requests and advisories, and is included in the plan.
Does a scan run on a schedule?
Advisory re-evaluation runs daily for affected applications. Everything else is event-driven: you push, you open a pull request, or you press scan.
Something here wrong, missing or out of date? Tell us and we will fix the page.