> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/owasp-scanner-reference.md).

# OWASP Dependency-Check step configuration

You can scan your code repositories using [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/) and ingest your scan results into Harness STO.

### Important notes for running OWASP scans in STO <a href="#important-notes-for-running-owasp-scans-in-sto" id="important-notes-for-running-owasp-scans-in-sto"></a>

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).

### OWASP step configuration <a href="#owasp-step-configuration" id="owasp-step-configuration"></a>

The recommended workflow is to add an OWASP step to a Security or Build stage and then configure it as described below.

#### Scan Mode <a href="#scan-mode" id="scan-mode"></a>

#### Scan Configuration <a href="#scan-configuration" id="scan-configuration"></a>

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

**Workspace**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the OWASP [`dependency-check`](https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html) scan with additional CLI flags, for example:

`--disableYarnAudit --log /shared/scan_logs/owasp.txt` Use these flags to authenticate with the Sonatype OSS Index vulnerability database. Providing authentication helps avoid rate limits and improves the reliability of vulnerability lookups.

`--ossIndexUsername` and `--ossIndexPassword`\
Use these flags to authenticate with the OSS Index database to retrieve vulnerability information.

`--disableOssIndex`\
Use this flag to disable the OSS Index vulnerability database and to rely only on the NVD for vulnerability information.

With these flags, the scanner skips the yarn Audit Analyzer and outputs the log to a shared folder, where it can be accessed by a later step.

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Configure OWASP Dependency-Check as a Built-in Scanner <a href="#configure-owasp-dependency-check-as-a-built-in-scanner" id="configure-owasp-dependency-check-as-a-built-in-scanner"></a>

The OWASP Dependency-Check is available as a [built-in scanner](/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/built-in-scanners.md) in STO. Configuring it as a built-in scanner enables the step to automatically perform scans using the free version without requiring any licenses. Follow these steps to set it up:

1. Search for **SCA** in the step palette or navigate to the **Built-in Scanners** section and select the **SCA** step.
2. Select **OWASP Dependency-Check** from the list of scanners.
3. Expand the **Additional CLI Flags** section if you want to configure optional CLI flags.
4. Click **Add Scanner** to save the configuration.

The scanner will automatically use the free version, detect scan targets, and can be further configured by clicking on the step whenever needed.

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

### Troubleshoot Yarn Audit Analyzer exceptions <a href="#troubleshoot-yarn-audit-analyzer-exceptions" id="troubleshoot-yarn-audit-analyzer-exceptions"></a>

The full exception is: `[DependencyCheck] [ERROR] Exception occurred initializing Yarn Audit Analyzer`

The OWASP scan step does not include a Yarn package out of the box. Harness seeks to keep these images as small and as lightweight as possible, and to minimize the number of vulnerabilities in each image.

To scan a repository that uses Yarn or another package that isn't in the base image, create a custom OWASP scanner image with the packages you need. For more information, go to [Create custom scanner images](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/create-custom-scan-images.md). This topic includes a step-by-step workflow for [creating a custom image with OWASP, Yarn, and PNPM](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/create-custom-scan-images.md#hands-on-example-add-yarn-and-pnpm-to-an-owasp-image).

If you get this message when scanning a repo that doesn't use Yarn, there might be an errant `yarn.lock` file somewhere in the repo. To disable the OWASP Yarn Audit Analyzer, add the option `--disableYarnAudit` to [Additional CLI flags](/security-testing-orchestration/use-sto/sto-scanner-configuration/owasp-scanner-reference.md#additional-cli-flags) in the OWASP scan step.