What’s Covered
Each section includes step-by-step instructions, configuration examples, and practical use cases to help you evaluate how SCANOSS fits your organisation’s needs.
How Scanning Works
Before you run your first scan, it’s worth understanding what actually happens to your code, since this is usually the first question a security or legal team asks. SCANOSS never uploads your source code. Every scan runs through the same three steps:- Fingerprint locally. Every SCANOSS tool follows the same procedure: it reads your files on your own machine or build runner and generates a Winnowing fingerprint, a compact set of hashes that represents each file’s content, not the content itself.
- Send fingerprints, not files. Only those fingerprints and hashes are sent to the SCANOSS API. There’s no step where your source code, file names, or repository contents leave your environment.
- Match and return. SCANOSS compares the fingerprints against its open-source knowledgebase and sends back matched components, licences, vulnerabilities, and cryptography, whichever datasets you enabled.
Every SCANOSS tool covered in this guide is open source, under
github.com/scanoss, so you can verify how
scanning works yourself rather than take our word for it. Contributions
are welcome. See Fast Winnowing &
Fingerprinting
for how the algorithm itself works.