> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/sto-scanner-configuration/shared/custom-scan/workflow.md).

# Workflow

This workflow applies to scanner integrations that support [`orchestratedScan`](/security-testing-orchestration/new-to-sto/key-concepts/run-an-orchestrated-scan-in-sto.md) or [`dataLoad`](/security-testing-orchestration/new-to-sto/key-concepts/extraction-scans.md) scan modes.

1. Add a **Build** or **Security** stage to your pipeline.
2. If you're scanning a code repository, set up your [codebase](/continuous-integration/use-harness-ci/use-harness-ci/codebase-configuration/create-and-configure-a-codebase.md).
3. Add a [Custom Scan](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) step.
4. Review the [Important notes for Custom Scan steps](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md#important-notes-for-custom-scan-steps) for additional requirements and relevant information.

   If you're setting up a scan on a Kubernetes or Docker build infrastructure, you need to add a [Docker-in-Docker background step](/security-testing-orchestration/use-sto/sto-scanner-configuration/security-step-settings-reference.md#configuring-docker-in-docker-dind-for-your-pipeline) to the stage.
5. Add the relevant `key:value` pairs to **Settings**.