@scanverra/cli 0.3.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -3
- package/dist/cli.js +84 -84
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
Scan a codebase for hardcoded secrets, SAST vulnerabilities, dependency CVEs, IaC misconfigurations and code quality issues, then see the results in your [Scanverra](https://scanverra.com) dashboard.
|
|
4
4
|
|
|
5
5
|
- **Your source code stays on your machine.** The scan runs locally. See [What is uploaded](#what-is-uploaded).
|
|
6
|
-
- **Requires** Node.js 18 or newer
|
|
6
|
+
- **Requires** Node.js 18 or newer and a Scanverra API key. The **Free** plan includes one key; each uploaded scan counts toward your monthly free Repo Scanner scans (Pro, Team and Enterprise are unlimited).
|
|
7
7
|
- The package contains no scanner rules. It downloads them from Scanverra, verifies their Ed25519 signature, caches them, and refuses to run anything that is not signed by Scanverra.
|
|
8
8
|
|
|
9
9
|
## Quick start
|
|
@@ -131,7 +131,7 @@ To show findings in the GitHub Security tab:
|
|
|
131
131
|
|
|
132
132
|
## Rules and updates
|
|
133
133
|
|
|
134
|
-
Rules are cached for 24 hours, then revalidated (an unchanged bundle is not downloaded again). If the server is unreachable the cached rules are used for up to 14 days. A revoked key or a
|
|
134
|
+
Rules are cached for 24 hours, then revalidated (an unchanged bundle is not downloaded again). If the server is unreachable the cached rules are used for up to 14 days. A revoked key or a disabled account stops the CLI at the next check.
|
|
135
135
|
|
|
136
136
|
## CI: cache the rules
|
|
137
137
|
|
|
@@ -161,7 +161,7 @@ variables:
|
|
|
161
161
|
| --- | --- |
|
|
162
162
|
| `Not logged in ... an API key is required` | Run `scanverra login`, or set `SCANVERRA_API_KEY` |
|
|
163
163
|
| `API key was rejected` (401) | The key is wrong or was revoked. Create a new one under Dashboard > API keys |
|
|
164
|
-
| `
|
|
164
|
+
| `You have reached your free scan limit` (402) | The Free plan's monthly Repo Scanner scans are used up. Run with `--no-upload`, wait for next month, or upgrade. The message includes the pricing link |
|
|
165
165
|
| `Daily limit for downloading the scanner rules reached` (429) | Cache the rules folder in CI (see above). Cached rules keep working meanwhile |
|
|
166
166
|
| `Rules bundle is temporarily unavailable` (503) | A Scanverra-side problem. Retry shortly; cached rules are used automatically if you have them |
|
|
167
167
|
| `Rules bundle signature is invalid. Refusing to run it.` | Something between you and Scanverra altered the download (proxy or TLS inspection), or the cache is corrupt. Delete the cache folder and retry, and contact support if it persists |
|