Tutorials / Code & Cloud

Code Security

Prancer empowers teams to conduct full white-box scanning—combining Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Secret Detection—from within the platform. This module will walk you through how to integrate code repositories and enable automated code security testing.

Understanding Key Concepts

Collections act as a logical, permissioned container for PAC manifest files. They serve as organizational units and permission scopes.

A PAC Manifest File is the YAML file defining your target application’s configurations, scanning options, authentication, connectors, tags, and more.

Remote PAC Files: Instead of storing PAC files in the portal, the files can reside in a git repository and be managed via connectors—ideal for MSPs/MSSPs centralizing configurations.

Connectors—represented as distinct YAML configurations—manage integrations to external systems such as git providers or cloud APIs.

Collection-Level Settings: Overrides in collection settings apply to all PAC files under that collection.

Enabling Code Security Scanning

Follow these steps to activate code analysis capabilities in your project:

1\. Connect Your Code Repository

1. Go to Collection Management and select the desired collection.

2. Click the hamburger menu next to it, then choose Third Party Integration.

3. Scroll to the Code Repository section.

4. Choose your git provider— GitHub, Bitbucket, Azure DevOps, etc.—and click Connect.

5\. Configure Connector

Provide a name for your connector.

Specify whether it is connecting to an Application Code Repo or an IaC Repo.

Choose the target PAC manifest to associate with the connector.

Authenticate via your git provider and authorize access.

Select repository and branch, then click Finish.

Once complete, the connector will appear as Connected.

6\. Validate Connector Attachment

In the Collection Management view, you’ll now see the new connector listed.

Navigate to the Inventory Management page, locate the associated PAC, and open PAC Configuration.

You should now see the added AppCodeAnalysis section in the YAML manifest.

AppCodeAnalysis Configuration Explained

In your PAC YAML file, the following snippet enables code analysis features:

AppCodeAnalysis: SASTScan: true SecretsScan: true SCAScan: true Remote: false Rule: python IncrementalScan: true GitConnector: your_git_connector_name

SASTScan: Enables static code vulnerability scanning (e.g., SQL injection, cross-site scripting) ( docs.prancer.io, docs.prancer.io, docs.prancer.io, docs.prancer.io)

SecretsScan: Detects exposed credentials and sensitive artifacts in code ( docs.prancer.io)

SCAScan: Examines third-party dependencies and libraries for known vulnerabilities ( docs.prancer.io)

IncrementalScan: Targets only new or changed code components to optimize scanning efficiency ( docs.prancer.io)

Remote = false: Indicates analysis runs on Prancer's infrastructure (else, true may imply a self-hosted or pipeline-based scan) ( docs.prancer.io)

Rule: Specifies code language (e.g., python, java, etc.) to guide SAST engines.

GitConnector: References the named connector for repository access.

Run Options & Outcomes

You have two main options for executing code security scans:

1. Prancer-hosted scanning (Remote: false) — The platform runs the analysis and aggregates results.

2. User Run scans (Remote: true) — Executes within your system, or CI/CD environment; results still flow into the App Findings page.

Regardless of method, findings (SAST, SCA, Secrets) appear in your App Findings dashboard for review and remediation steps.

Summary Table

| Step | Action |

| 1 | Go to Collection Management → Third Party Integration → connect your git repo |

| 2 | During setup, link connector to specific PAC manifest |

| 3 | Validate connector attachment in PAC Configuration |

| 4 | Apply AppCodeAnalysis section in the PAC: enable SAST, SCA, Secrets, incrementals |

| 5 | Decide between remote scans vs. pipeline-hosted scans |

| 6 | Execute scan and review code findings in App Findings view |

Screenshots

Reference screenshots.