Enable vulnerability scanning

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This guide describes how to increase your security posture by enabling the vulnerability scanning feature in Secure Source Manager.

Vulnerability scanning automatically detects known vulnerabilities in the dependencies of your source code, scanning each new commit to a pull request. Vulnerabilities are presented both in pull request views, and in a repository-wide Security tab.

Note: Vulnerability scans are unavailable for Repositories exceeding 1 GB in size.

Enable vulnerability scanning

Ensure that the following roles and settings are enabled for your repository.

Required roles

To get the permission that you need to enable vulnerability scanning, ask your administrator to grant you the Secure Source Manager Repository Admin (roles/securesourcemanager.repoAdmin) IAM role on the Secure Source Manager repository. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the securesourcemanager.repositories.update permission, which is required to enable vulnerability scanning.

You might also be able to get this permission with custom roles or other predefined roles.

For information on granting Secure Source Manager roles, see Access control with IAM and Grant users instance access.

Update repository settings

You can activate vulnerability scanning for your repositories through the Secure Source Manager interface:

1. Navigate to the repository where you want to enable vulnerability scanning.
2. Click the Settings icon.
3. Locate the Vulnerability Scanning toggle.
4. Click the toggle to the On position.
5. Click the Update Settings button.

Working with vulnerability scanning

After you enable vulnerability scanning, the following scans occur automatically:

• Scheduled Scans: The head commits of all branches, once per day.
• Pull Request Scans:
  • The head commits of new pull requests, on pull request creation.
  • New commits pushed to pull requests, on push.

Only vulnerabilities from dependencies of your code are detected. Vulnerability scans detect vulnerabilities listed in public databases including, but not limited to, the National Vulnerability Database and the GitHub Advisory Database. Detected vulnerabilities include an external link to the public database data on the vulnerability, and, when available, the CVE ID.

Security Tab

After you enable vulnerability scanning, a Security tab is shown on the repository's navigation bar, which you can use to search for scanned vulnerabilities up to a retention period of 3 years.

Note: Vulnerabilities that continue to affect new repository commits will continue to be displayed, even if they were originally detected outside the retention period.

The Security tab includes results from both scheduled and pull request scans.

By default, the Security tab's Found In filter will be set to the most recently browsed branch (or the repository's default branch). To view other vulnerabilities, adjust or clear the Found In filter.

The Security tab includes the following data on each vulnerability:

• Severity: The security severity of the vulnerability, as rated by the public vulnerability database source.
• ID: The public CVE ID, if available, else another identifier such as the GHSA ID. Also, if available, an external link to the public database entry for the vulnerability.
• Found In: The Git commit SHA that was scanned, as well as a list of all Git branches, Git tags, or pull requests for which this is the latest commit.
• File: The repository source file that included the vulnerable dependency and, if available, the line number.
• Package: The dependent package name and its version containing the vulnerability. If known, the version of the package that addresses the vulnerability is also listed.
• Description: If available, a description of the vulnerability.
• Detected: The date of the scan that detected the vulnerability.

The following filters are available in the Security tab:

• Severity: Only display vulnerabilities with the specified severity (CRITICAL, HIGH, MEDIUM, or LOW).
• Found In: Only display vulnerabilities detected in the specified Git branch, tag, or commit SHA.
• File: Only display vulnerabilities detected in the specified source path. Accepts substrings; for example, project/ can be used to filter to vulnerable dependencies in the project/ directory.
• Vulnerability: Search a vulnerability by its public data such as its ID, description, or affected package name. Accepts substrings.
• Date From and To: Only display vulnerabilities which were detected after or before the given dates, respectively. Format: YYYY-MM-DD.

Pull Requests

Once a pull request scan completes, detected vulnerabilities are displayed in the pull request Conversation tab. Scans check all repository files. Vulnerabilities from files not modified in the pull request may be included.

Pull requests display an abridged view of the top detected vulnerabilities. To see the full list and details of vulnerabilities for the pull request, click the Full Results link to view them in the repository Security tab.

Vulnerabilities don't block pull requests from being merged.

Tip: To force an existing pull request to be scanned or re-scanned, push a new commit to its head branch.

Supported File Types

Package files for the following languages will be scanned for dependency vulnerabilities:

	Supported
Go
Java
JavaScript
Node.js
PHP
Python
Ruby
Rust
TypeScript
.NET

Note: The following language findings may not include line numbers: PHP, Ruby, Rust, and .NET.

What's next

• Enable secret scanning
• Branch protection overview