Scanning

Scan types

Scan type	Tests	Give it
Static code analysis (SAST)	Source code, against Cerberon's own rule pack. Runs entirely on the machine.	A Git repository URL, or an uploaded archive of the code
Dependency vulnerabilities (SCA)	Every component the project uses, against the advisory databases; flags known-exploited vulnerabilities.	A Git repository, an uploaded archive or lockfile, a container image, or an SBOM
Dynamic application test (DAST)	A running web application or API: an agent exercises it and reports findings with evidence.	The base URL; for an API, the base URL plus a Postman, OpenAPI/Swagger or HAR collection
Penetration test	A host you own: an agent chooses the tools, reads their output and reports findings with evidence.	A host name or IP address
Cloud security audit	An AWS, Azure or GCP account: IAM, exposed storage and other CIS benchmark gaps.	The account, with its credential stored in Cerberon
Kubernetes posture	A cluster: RBAC, secrets handling, workload specs, against the CIS Kubernetes Benchmark.	The cluster, with its credential stored in Cerberon
Mobile static analysis	An Android APK or iOS IPA: manifest and component exposure, network security, signing, hardening.	The app file

Which scan types you can start depends on your licence.

Agent-assisted scans (DAST, penetration test, cloud, Kubernetes) are carried out by an AI agent and need an AI provider set under Settings → AI. Credentials for cloud accounts and clusters are stored on the server and never sent to the browser.

Start a scan

Choose New scan, pick the scan type and the target, and start it. Two confirmations protect you:

Testing a system (DAST, penetration test) needs you to confirm you are authorised to test it. Testing a system you do not own or have written permission to test is a criminal offence in most jurisdictions.
Reading source code (SAST, and any scan of a repository or archive) needs you to acknowledge that the scan reads your source.

A scan is refused, with the reason, rather than started when the machine is short of memory, disk or CPU for it, when the scanner tools are missing, or while an update is in progress.

Time limits

Every scan stops when its time limit runs out. The defaults:

Scan type	Default limit
Static code analysis	6 hours
DAST, penetration test, mobile	2 hours
Everything else	24 hours

Each scan can set its own limit, from 30 minutes to 7 days.

Schedules

A scan can repeat on a schedule. A scheduled run that comes due while Cerberon is updating, or while the machine is off, runs as soon as Cerberon is back and is marked ran late; it is never silently skipped. A schedule stops (and says why) if the person who created it is removed or loses access to its project.

Projects and roles

Scans belong to projects. People see the projects they are members of; administrators see all of them.

Role	Can
Administrator	Everything, including users, settings, licence and updates
Analyst	Start and manage scans, triage findings, produce reports, in their projects
Viewer	Read scans, findings and reports in their projects

Findings and reports

Each finding carries its severity, evidence and the scanner that found it.
Each finding moves through a review: open, in review, to fix, fixed, or decided as a false positive, an accepted risk or won't fix.
Analysts can lower a finding's severity with a written justification, never raise it above the scanner's rating.
Reports download as Standard or Summary, and can be shared by link.

Start scans from CI

Create an API token under Settings → Access → API tokens (scope write to start scans). Tokens expire after 90 days by default. Then, in your pipeline:

curl -sS -X POST "https://cerberon.example.com/api/jobs" \
  -H "Authorization: Bearer $CERBERON_TOKEN" \
  -H "content-type: application/json" \
  -d '{"capability":"sca","target":{"kind":"git","url":"https://git.example.com/team/app.git"},
       "consent":{"acknowledged":true,"mode":"rules-only"}}'

The answer (HTTP 201) carries the scan's id. Follow it with:

curl -sS "https://cerberon.example.com/api/jobs/<id>" -H "Authorization: Bearer $CERBERON_TOKEN"

until job.status is succeeded, failed or cancelled; the same answer lists the findings, each with its severity, so the pipeline can fail on what you choose.

capability is the scan type: sast, sca, dast, pentest, cloud, k8s or mobile.
consent is required whenever the scan reads source code (any git target, SAST, an uploaded archive).
Use -k with curl while Cerberon still uses its own certificate, or better, supply yours (configuration).
During an update, starting a scan answers HTTP 503 with Retry-After; retry after that many seconds.