---
title: "Scanners"
description: "The scanners whose reports AppSec Portal reads, what each one scans and which Auditor job runs it."
url: https://whitespots.io/docs/appsec-portal/find-vulnerabilities/scanners
slug: appsec-portal/find-vulnerabilities/scanners
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---

# Scanners

Portal reads the reports of the scanners below. The name in the first column is
the scanner name to use when you [import a report](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/import-scan-results) and in the `SCAN_TYPE`
variable of an Auditor job.

The last column names the [Auditor job](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits/sequences) that runs the scanner. A
scanner without a job reads reports that you import; to run it from Auditor, add a job
for it as described in [Bring your own scanner](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/bring-your-own-scanner).

To see all scanners, including your own, open the settings, then **Scanners**. Built-in scanners
and your own ones are on separate tabs.

## Secrets

| Scanner | Scans | Auditor job |
| --- | --- | --- |
| Gitleaks Scan | repository | Gitleaks Scan |
| GitLab Gitleaks | repository | GitLab Gitleaks |
| Trufflehog3 Scan | repository | Trufflehog3 Scan |
| FVLCN Secrets Hunter | repository | FVLCN Secrets Hunter |
| FVLCN Domains Secrets Hunter | domain | FVLCN Domains Secrets Hunter |

## Code

| Scanner | Scans | Auditor job |
| --- | --- | --- |
| Bandit Scan | Python code | Bandit |
| Checkov Scan | infrastructure as code | Checkov |
| CodeQL Scan (SARIF) | code | |
| ESLint Scan | JavaScript code | ESlint |
| GitLab Bandit | Python code | |
| GitLab ESLint | JavaScript code | |
| GitLab KICS | infrastructure as code | |
| GitLab Semgrep | code | Gitlab Semgrep, Gitlab Nodejs, Gitlab Php |
| Gosec Scanner | Go code | Gosec |
| Hadolint | Dockerfiles | |
| Mobsfscan | Android and iOS code | Mobsfscan |
| PHPCodeSniffer | PHP code | PHPCodeSniffer |
| Semgrep JSON Report | code | Semgrep |
| Snyk | code, dependencies and infrastructure as code | Snyk Go, Snyk Nodejs, Snyk Python, Snyk Iac |
| Terrascan Scan | infrastructure as code | Terrascan |
| Whitespots AI SAST | code, with a language model | Whitespots AI SAST |

## Dependencies

| Scanner | Scans | Auditor job |
| --- | --- | --- |
| Dependency-Track | software bills of materials | |
| GitLab Gemnasium | repository | |
| Retire.js Scan | JavaScript libraries | Retirejs |
| Trivy Scan | repository, Docker image | Trivy Code Dependencies, Trivy Image Dependencies |
| Vulners Trivy | Docker image | Vulners Trivy |

## Web

| Scanner | Scans | Auditor job |
| --- | --- | --- |
| Arachni Scan | domain | Arachni |
| Burp Enterprise Scan | web application | |
| GitLab OWASP Zap | web application | |
| Nessus | host | |
| Nuclei Scan | domain | Nuclei Scan, Nuclei Scan CVE |

## Infrastructure

These two scanners find assets, not vulnerabilities. Their reports add assets to the product of
the audit and create no findings.

| Scanner | Scans | Auditor job |
| --- | --- | --- |
| Subfinder | domain: adds its subdomains as domain assets | Subfinder |
| Naabu | domain: adds each address with an open port as a host asset, or as a domain asset when it's a name | Naabu |

## Cloud

| Scanner | Scans | Auditor job |
| --- | --- | --- |
| AWS Security Hub Scan | AWS account | |
| Prowler | AWS account | Prowler AWS |
| Whitespots Portal | Microsoft Defender alerts | Defender Alerts |

Some jobs need a key of the scanner's vendor in their environment variables: `SNYK_TOKEN` for Snyk
Iac, `VULNERS_API_KEY` for Vulners Trivy, and `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` for
Prowler AWS.

Whitespots AI SAST runs a small model on the Auditor worker by default. To use a
hosted model instead, edit the job's run command, which has the other options commented out, and
set the provider's API key in the job's variables.

---

## Navigation

- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal) > [Find vulnerabilities](https://whitespots.io/docs/appsec-portal/find-vulnerabilities)
- Previous: [Sequences and jobs](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/audits/sequences)
- Next: [Bring your own scanner](https://whitespots.io/docs/appsec-portal/find-vulnerabilities/bring-your-own-scanner)