Auto Scan

Auto Scan automatically triggers security scans when code changes occur in your GitHub repositories.

​

Scan Triggers

When enabled, auto-scan runs on:

​

Enabling Auto Scan

​

Per Repository

1. Go to Repositories
2. Click settings (gear icon) on a repository
3. Toggle “Auto Scan” on

​

For All Repositories

1. Go to Settings → Integrations → GitHub
2. Enable “Auto Scan for New Repositories”
3. New repositories will have auto-scan enabled by default

​

Configuration Options

​

Default Branch Scanning

Control when default branch scans occur:

• On merge - Scan after PR merges (recommended)
• On push - Scan every push to default branch
• Disabled - Don’t scan default branch automatically

​

PR Scan Settings

Configure PR scanning behavior:

​

Scan Frequency

Vidoc rate-limits scans to prevent abuse:

• PR scans - Immediate, one per PR update
• Default branch - Batched if multiple merges occur quickly

​

Scan Status

Monitor auto-scan status:

1. Webhook delivery - Check GitHub webhook settings
2. Scan history - View in Repositories → [Repo] → Scans
3. PR status - Check the Pull Requests page

​

Disabling Auto Scan

​

Per Repository

1. Go to Repositories
2. Click settings on the repository
3. Toggle “Auto Scan” off

​

Temporarily

Use branch patterns to exclude branches:

1. Repository settings → “Ignored Branches”
2. Add patterns (e.g., feature/*)

​

Troubleshooting

​

Scans Not Triggering

1. Verify GitHub integration is connected
2. Check webhook delivery in GitHub repo settings
3. Ensure auto-scan is enabled for the repository
4. See Troubleshooting

​

Duplicate Scans

If you see duplicate scans:

1. Check if CLI and auto-scan are both running
2. Verify webhook isn’t configured multiple times

​

Related Pages