Scanning Dependencies
UseDependencyScanner to detect open-source dependencies from manifest files such as
package.json, pom.xml, and requirements.txt:
Scanning for Cryptography
UseCryptographyScanner to detect cryptographic algorithms and libraries in local source
files. This scanner runs entirely locally and does not send any data to the API:
Note:CryptoCfgfollows a different naming convention toDependencyScannerCfg. Both are valid configuration classes; the naming difference reflects the underlying API design.
Generating Winnowing Fingerprints (WFP) Without Scanning
To generate Winnowing Fingerprints (WFP) locally without sending data to the API, use theFingerprint class. Use setFingerprintPath to specify where the .wfp output file will
be written:
Scanner Events Reference
TheScanner class (and Fingerprint, which shares the same event system) emits the
following events, which can be subscribed to via .on():
| Event | Description |
|---|---|
SCAN_DONE | Scan completed; provides the path to the results file |
SCANNER_LOG | Internal log messages emitted by the scanner |
DISPATCHER_NEW_DATA | New results received from the server; not yet written to the output file |
RESULTS_APPENDED | Buffered results written and appended to the output file |
WINNOWING_STATUS | Progress update during fingerprint generation |
ERROR | An error occurred during scanning |