Documentation
Security & privacy
Scanner is designed to be useful before an organization grants a new vendor access to source or telemetry. Local and CI scans stay on infrastructure you control unless an upload is explicitly enabled.
Execution model
Cerbi Scanner is a local static-analysis tool. It reads source files under the scan target, evaluates logging calls against built-in or repository policy, and writes findings locally. It does not modify the application or require a Cerbi control-plane connection.
cerbi-scanner scan . --fail-on none --no-snippetsNo account required
What leaves the machine
| Data | Default behavior | Notes |
|---|---|---|
| Source code | Not uploaded by default | Scanner performs local static analysis and does not modify source files. |
| Source snippets | Not serialized in standard reports | The Azure DevOps wrapper additionally passes --no-snippets by default for shared CI artifacts. |
| File paths | May appear in findings | Treat generated reports as internal artifacts unless paths have been reviewed or normalized. |
| Log message templates | May appear | Templates can contain field names; Scanner does not observe runtime field values. |
| Sensitive literals | Best-effort redaction | Report explanations pass through Scanner redaction before serialization. |
| Telemetry / analytics | None | The Scanner pipeline has no analytics or telemetry sink. |
| CerbiShield upload | Off by default | Network upload requires explicit opt-in and the required credential. |
Report redaction
Before finding explanations are serialized, Scanner applies best-effort redaction for password/secret/token assignments, connection-string password fields, and long credential-like token values. This reduces accidental exposure in reports, but it is not a substitute for reviewing an artifact before making it public.
Do not publish reports blindly
Azure DevOps data flow
The Azure DevOps task runs Scanner on the existing build agent. It does not send source code, findings, or report files to a Cerbi service by default. Generated reports stay in the pipeline workspace and can be published as Azure DevOps artifacts or summaries when configured.
The wrapper may access the network to install prerequisites when those options are enabled: .NET 10 can be installed on an agent that does not have it, and the Cerbi.Scanner global tool can be restored from the configured NuGet feed. Locked-down self-hosted agents can preinstall both and disable those install steps.
Explicit upload
Scanner has an upload path for future/optional CerbiShield workflows, but it is disabled unless the caller explicitly passes --upload and supplies the required authentication configuration. Omitting the opt-in keeps the scan local.
If your organization only needs discovery or CI gating, you can use Scanner indefinitely without enabling upload. See CI/CD integration for local pipeline examples.