Help & Documentation

Everything you need to connect a provider, run a scan, and understand your results.

• Overview
• Connecting a Provider
• Understanding Findings & Severity
• Cloud-Credential-Leak Correlation
• Reachability Analysis
• Continuous Registry Monitoring
• Billing & Trial
• CI/CD Pipeline Gate

Overview

Prasovi scans two kinds of things: your code repositories, for hardcoded secrets, insecure code patterns, and vulnerable dependencies; and your cloud infrastructure accounts, for security misconfigurations. Getting started is three steps: connect an account, run a scan (a single repository or your whole provider at once), then review the severity-ranked findings in your dashboard.

Connecting a Provider

Each provider below needs its own credential — a personal access token, API token, or cloud credential pair — which you provide from that provider's own connect page (linked below). Every credential is encrypted at rest and only decrypted in memory for a scan you explicitly trigger.

Code Scanning

Cloud Infrastructure Scanning

Understanding Findings & Severity

Code scans run three tools together: gitleaks (hardcoded secrets), semgrep (insecure code patterns), and trivy (known vulnerabilities in dependencies). Cloud infrastructure scans run Prowler against your connected AWS, Azure, or GCP account. Kubernetes and container registry scans both run trivy — the same vulnerability database as code scans, applied to a live cluster or a pushed image instead of a repository.

Every finding is ranked critical, high, medium, or low, shown on your scan history and on each scan's detail page. A scan itself has one of three statuses: pending (still running), complete (finished — check its findings), or failed (something went wrong before results could be produced, most often a token that no longer has access to the repository).

Cloud-Credential-Leak Correlation

If a code scan finds a hardcoded secret that matches a cloud credential you've also connected for infrastructure scanning, Prasovi flags it as a confirmed credential leak — not just "this looks like a key", but "this is the actual key to the AWS account/Azure subscription/GCP project you connected". These findings are marked distinctly on the scan detail page so you can prioritize them first — a confirmed leak of live credentials is a more urgent problem than a pattern match alone.

Reachability Analysis

For dependency/CVE findings, Prasovi checks whether the vulnerable package is actually imported anywhere in your scanned code — cutting through the noise of CVEs sitting in dependencies your code never actually exercises. Each finding is marked Reachable, Unreachable, or Unknown on the scan detail page.

This checks at the package level — whether the package is imported at all — not whether the specific vulnerable function inside it is called; CVE data doesn't reliably identify which function is affected, so that finer precision isn't something we can honestly claim. It's also Python-only for now. Unknown is the honest result whenever reachability can't be determined — a non-Python dependency, or anything the check couldn't resolve — rather than a guess in either direction.

Continuous Registry Monitoring

Unlike every other connector, a monitored container image isn't scanned only when you click "Scan" — once added, it's automatically rescanned every 24 hours for as long as it stays on your monitored list, so newly-disclosed CVEs in an image you already pushed get caught without you doing anything. Each rescan shows up in your scan history exactly like a manual one.

This is a paid-plan feature, not available on trial — continuous monitoring is a meaningfully larger ongoing commitment than a one-off scan, so it's gated separately. Each paid plan caps how many images may be monitored at once (shown on the Registries page and on Billing); removing an image frees its slot for another.

Adding an image checks that your connected credentials can actually read that specific repository, not just that they're valid — a credential scoped for infrastructure scanning isn't guaranteed to also have registry-read access, so this is checked explicitly before the image is added, with a clear message if it's a permissions gap rather than an invalid credential.

Billing & Trial

Every new account starts on a 7-day free trial: 3 code scans and 1 infrastructure scan, no credit card required. Once your trial scans are used or the trial period ends, you get 1 free scan a week. Paid plans are coming soon — see Billing for the plans and your current usage.

CI/CD Pipeline Gate

Mint a scoped token per repository from Settings, then trigger a scan from GitHub Actions, GitLab CI, Azure Pipelines, or Bitbucket Pipelines to get a pass/fail result — without sharing your own login. You can set which severity fails the build, and separately choose to always fail on any cloud-credential-leak correlation regardless of severity. See the full setup guide for your CI system →. Questions? Reach out at [email protected].