> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/prezero/tutorials/juiceshop.md).
# OWASP Juice Shop
This article will show you how to scan the [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/) app with Qwiet AI by Harness.
## Prerequisites
You must have Qwiet AI by Harness [installed and authenticated](broken://spaces/uPVBkglG6gsk2SsnsKgG/pages/TttvRsX00hNaoDKOB7NC).
You must have a copy of the OWASP Juice Shop; you can obtain the latest OWASP Juice Shop app via [GitHub](https://github.com/juice-shop/juice-shop). You can clone the repo to your workstation and run Qwiet AI by Harness locally, or you can fork the repo and create a GitHub Action that calls Qwiet AI by Harness.
## Preparing the app for analysis
OWASP Juice Shop is a JavaScript/TypeScript app, and analyzing it is similar to [analyzing most other JavaScript/TypeScript apps](/sast-and-sca/prezero/static-analysis-sast/analyzing-applications/javascript.md). However, there are several steps that you should take when [scanning Node.js apps](/sast-and-sca/prezero/static-analysis-sast/analyzing-applications/javascript.md#scanning-nodejs-applications) (of which Juice Shop is one).
If you're running Qwiet AI by Harness locally, navigate into the Juice Shop folder, then:
1. Run `npm install` and remove `node_modules`:
```prism-code
npm install
rm -rf node_modules
```
 
2. If present, you should also remove any directory that your build produces that Qwiet AI by Harness should *not* include in the analysis (e.g., `build` or `dist` directories):
```prism-code
rm -rf frontend/dist frontend/node_modules dist build
```
 
If you're integrating Qwiet AI by Harness into your deployment pipeline, you'll need to include these instructions explicitly. For example, if you're using [GitHub Actions](/sast-and-sca/prezero/static-analysis-sast/workflows/github.md) to analyze code changes during the pull request process, you'll [include something similar to following in your configuration file](https://github.com/ShiftLeftSecurity/juice-shop/blob/master/.github/workflows/main.yml#L29):
```
- name: Repo prep for JS apps
run: |
npm install
rm -rf node_modules
rm -rf frontend/dist frontend/node_modules dist build
```
 
## Analyzing the application
Once you've prepped the app, you'll need to call `sl analyze` to begin the code analysis process.
```
sl analyze --app juice-shop-training --js . \
-- --with-tests --exclude node_modules --exclude frontend/dist --exclude frontend/node_modules --exclude vagrant --exclude dist --exclude data/static --exclude build
```
 
Alternatively, you can use something like [GitHub Actions to automate the process](https://github.com/ShiftLeftSecurity/juice-shop/blob/master/.github/workflows/main.yml#L36)
> See [sl analyze](broken://spaces/4t03gua31tHpZwtcczPO/pages/bfq0NtVB7O7f6pFvFzK3) for more information about `sl analyze` and its options.
Note the `--` followed by additional flags. For JavaScript/TypeScript apps, Qwiet AI by Harness accepts a variety of [additional parameters](/sast-and-sca/prezero/static-analysis-sast/analyzing-applications/javascript.md#additional-parameters).
For Juice Shop, you'll need:
* `--with-test`: Include test files
* `--exclude node_modules --exclude frontend/dist --exclude frontend/node_modules --exclude vagrant --exclude dist --exclude data/static --exclude build`: Exclude the specified directories during code analysis
> Please note that the OWASP Juice Shop app analysis can take 20-30 minutes (or more) to complete.