Scan Source Code with QScanner

QScanner enables you to scan source code repositories for security risks before applications are built and deployed.

Use QScanner code scanning to identify:

• Software Composition Analysis (SCA) findings in open source packages and dependencies
• Secrets exposed in source code
• AI compliance findings associated with application code

Code scan results are uploaded to Qualys and represented as Code Assets, where findings can be prioritized using TruRisk and correlated with downstream container images.

Before You Begin

Before running a code scan:

• Download and configure QScanner for your Qualys platform.
• Generate or obtain a valid Qualys access token.
• Set the access token as the QUALYS_ACCESS_TOKEN environment variable.
• Ensure QScanner can access the repository or local source code that you want to scan.

Scan a Remote Code Repository

Use remote repository scanning when QScanner can access the source code repository directly.

Run:

./qscanner --pod <platform> --scan-types sca code <target> --access-token $QUALYS_ACCESS_TOKEN

Replace:

• <platform> with your Qualys platform.
• <target> with the remote code repository that you want to scan.

Example

./qscanner --pod <platform> --scan-types sca code https://github.com/example-org/example-app.git --access-token $QUALYS_ACCESS_TOKEN

QScanner retrieves the repository, scans the source code, and sends the resulting inventory and findings to the Qualys platform.

Scan a Local Code Repository

Use local repository scanning when the source code has already been checked out on the system where QScanner is running. This model is commonly used within CI/CD pipelines after the source repository has been cloned.

Run:

./qscanner --pod <platform> --client-id $QUALYS_CLIENT_ID --client-secret $QUALYS_CLIENT_SECRET --scan-types sca code <local_repo_target>

Replace <local_repo_target> with the path to the source code directory.

Example: Scan the Current Repository

./qscanner --pod <platform> --client-id $QUALYS_CLIENT_ID --client-secret $QUALYS_CLIENT_SECRET --scan-types sca code .

Example: Exclude Specific Directories

./qscanner --pod <platform> --client-id $QUALYS_CLIENT_ID --client-secret $QUALYS_CLIENT_SECRET --scan-types sca code /workspace/example-app --exclude-dirs **/testdata

Scan Code in a CI/CD Pipeline

For CI/CD workflows, run QScanner after the source code has been checked out and before or during the application build.

For example:

Source Repository
      ↓
Checkout Code
      ↓
QScanner Code Scan
      ↓
Build Application
      ↓
Build Container Image
      ↓
Push Image to Registry
      ↓
Deploy

After the repository is checked out, run:

./qscanner --pod <platform> --client-id $QUALYS_CLIENT_ID --client-secret $QUALYS_CLIENT_SECRET --scan-types sca code .

This allows Qualys to assess the application source before the resulting artifact is deployed.

Code Scan Examples

Scan a GitHub Repository Remotely

./qscanner --pod <platform> --client-id $QUALYS_CLIENT_ID --client-secret $QUALYS_CLIENT_SECRET --scan-types sca code https://github.com/example-org/payments-service.git

Scan a Checked-Out Git Repository

cd payments-service
./qscanner --pod <platform> --client-id $QUALYS_CLIENT_ID --client-secret $QUALYS_CLIENT_SECRET --scan-types sca code .

Scan Code from a Pipeline Workspace

./qscanner --pod <platform> --client-id $QUALYS_CLIENT_ID --client-secret $QUALYS_CLIENT_SECRET --scan-types sca code /workspace/source

View Code Scan Results

After the scan completes, go to:

Qualys Enterprise TruRisk™ Platform > Container Security > Assets > Code

The scanned repository is represented as a Code Asset.

From the Code Asset, you can review:

• TruRisk™
• Vulnerable software and SCA findings
• Secrets
• AI compliance findings
• Repository and scan metadata
• Associated container images

Connect Code to Cloud

When QScanner runs as part of the software delivery pipeline, Qualys can collect pipeline metadata that associates the source repository with the container images produced from that code.

This creates a relationship such as:

Code Repository
      ↓
CI/CD Pipeline
      ↓
Container Image
      ↓
Registry
      ↓
Cloud / Runtime

From a Code Asset, you can use Associated Images to identify container images built from the repository.

This allows you to start with a finding in source code and determine whether that code was subsequently packaged into an image and deployed into your environment.

For example:

Vulnerable dependency found in the repository
                    ↓
          Associated container image
                    ↓
             Deployed workload

This code-to-cloud context helps teams determine whether a development-stage risk has downstream impact and prioritize remediation accordingly.