> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/sto-scanner-configuration/shared/sto-supported-categories.md).

# Sto Supported Categories

The following list shows the scan types that STO supports:

* **SAST (Static Application Security Testing)** scans a code repository and identifies known vulnerabilities in open-source and proprietary code.
* **SCA (Software Composition Analysis)** scans a code repository and identifies known vulnerabilities in open-source libraries and packages used by the code.
* **Secret Scanning** scans a code repository and identifies all secrets such as access keys and passwords.
* **DAST (Dynamic Application Security Testing)** scans a running application for vulnerabilities by simulating a malicious external actor exploiting known vulnerabilities.
* **Container Scanning** identifies vulnerabilities in container images.
* **IaC** identifies vulnerabilities in Infrastructure as Code scripts that automatically provision and configure infrastructures.