> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/harness-security-scanners/shared/sto-supported-scanners.md).
# Sto Supported Scanners
The following sections describe the scanners supported by Harness STO, based on the target type:
* [Code repo scanners](#code-repo-scanners)
* [Artifact scanners](#artifact-scanners)
* [Instance scanners](#instance-scanners)
* [Configuration scanners](#configuration-scanners)
* [Other scanners](#other-scanners)
In addition to the listed supported scanners, the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](/security-testing-orchestration/new-to-sto/sto-whats-supported/scanners.md#scanners-supported-with-custom-scan-step).
**Code repo scanners**
A code scanner can detect one or more of the following issue types in your source code. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.
* **SAST (Static Application Security Testing):** Known vulnerabilities in open-source and proprietary code.
* **SCA (Software Composition Analysis):** Known vulnerabilities in open-source libraries and packages used by the code.
* **Secrets:** Hard-coded secrets such as access keys and passwords.
* **IaC:** Known vulnerabilities in Infrastructure-as-Code files such as Terraform configurations.
* **Misconfigurations:** Known vulnerabilities in software configurations.
| Open Source | Commercial |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| - Aqua Trivy Orchestration, Ingestion
- Bandit Orchestration, Ingestion
- Brakeman Orchestration, Ingestion
- Coverity Ingestion
- Gitleaks Orchestration, Ingestion
- Grype Orchestration, Ingestion
- ModelScan Orchestration, Ingestion
- Open Source Vulnerabilities (OSV) Orchestration, Ingestion
- OWASP Dependency Check Orchestration, Ingestion
- Reapsaw Ingestion
- Semgrep Code (open-source option) Orchestration, Ingestion
- SonarQube/SonarCloud (free option) Orchestration, Extraction, Ingestion
- Checkov Orchestration, Ingestion
| - Harness Code Orchestration
- Black Duck Hub Orchestration, Extraction, Ingestion
- Checkmarx Orchestration, Extraction, Ingestion
- Checkmarx One Orchestration, Extraction, Ingestion
- CodeQL Ingestion
- Data Theorem Extraction, Ingestion
- Fortify on Demand Orchestration, Extraction, Ingestion
- Fortify Static Code Analyzer Ingestion
- Fossa Ingestion
- GitHub Advanced Security Orchestration, Extraction, Ingestion
- Mend (formerly WhiteSource) Orchestration, Extraction, Ingestion
- Nexus IQ Orchestration, Extraction, Ingestion
- Semgrep Code (paid option) Orchestration, Ingestion
- Snyk Code Orchestration, Ingestion
- Snyk Infrastructure as Code Orchestration, Ingestion
- Snyk Open Source Orchestration, Ingestion
- SonarQube/SonarCloud Orchestration, Extraction, Ingestion
- Veracode Orchestration, Extraction, Ingestion
- Wiz Orchestration, Ingestion
|
**Artifact scanners**
An artifact scanner can detect one or more of the following issue types in your container images and other artifacts. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.
* **SCA (Software Composition Analysis):** Known vulnerabilities in open-source libraries and packages used by the code.
* **Container Scanning:** Identify vulnerabilities in container images.
| Open Source | Commercial |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| | - Harness Container Orchestration
- Anchore Enterprise Orchestration, Extraction, Ingestion
- Aqua Security Orchestration, Ingestion
- AWS ECR Extraction
- Black Duck Hub Orchestration, Extraction, Ingestion
- Docker Content Trust (DCT) Orchestration, Ingestion
- Mend (formerly WhiteSource) Orchestration, Extraction, Ingestion
- Prisma Cloud (formerly Twistlock) Orchestration, Extraction, Ingestion
- Snyk Container Orchestration, Ingestion
- Sysdig Orchestration, Ingestion
- Tenable.io Orchestration, Ingestion
- Wiz Orchestration, Ingestion
- JFrog Xray Ingestion
|
**Instance scanners**
An instance scanner scans a running application for vulnerabilities by simulating a malicious external actor exploiting known vulnerabilities. This is also known as a DAST (Dynamic Application Security Testing) scan.
For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.
| Open Source | Commercial |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| | |
**Configuration scanners**
The following scanners detect misconfigurations in your cloud environment that can result in vulnerabilities. For information about the specific vulnerabilities detected by each scanner, go to the scanner provider's documentation.
| Open Source | Commercial |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| | |
**Other scanners**
If you use a scanner that isn't listed above, you can still ingest your scan results into STO.
* If your scanner can publish to SARIF format, go to [Ingest SARIF scan results into STO](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/ingest-sarif-data.md).
* For other scanners, go to [Ingest results from unsupported scanners](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/ingesting-issues-from-other-scanners.md).
{% @harness-feedback/feedback %}