Running an ArchSecurity scan

ArchSecurity performs CWE-tagged static analysis (SAST) and turns a single scan into four compliance frameworks.

Starting a scan

Run the runner in a push pipeline (full-scan mode); the ArchSecurity reports are derived from the same scan’s CWE-tagged findings:

# Image pulls are authorized with your INSTALLATION credential, not the project token
# (Settings → CI/CD → Variables):
#   DOCKER_AUTH_CONFIG = {"auths":{"hub.apparch.io":{"auth":"base64(<installation-id>:<installation-key>)"}}}
archsecurity:
  image: hub.apparch.io/collectors/dotnet:latest
  rules:
    - if: $CI_PIPELINE_SOURCE == "push"
  variables:
    APPARCH_Collector__Token: "$APPARCH_TOKEN"
    APPARCH_Collector__ApiUrl: "https://api.yourdomain.com"
  script:
    # Optional flags: --modules archpilot,archscan (pin what runs)
    #                 --fail-on critical (fail this step when findings at/above the level exist)
    - apparch "$CI_PROJECT_DIR"

or from the panel, ArchSecurity → (project) → Run scan.

Framework reports

Each finding is tagged with a CWE identifier; the framework reports are derived from this single spine:

Framework	Contents
OWASP Top 10	The 10 most common web risks
PCI-DSS	Card data compliance
STIG	Hardening guides
CASA	Application security assessment

In the panel, select the framework from the report tab; findings come ordered by severity.

Prioritization

Critical findings are listed at the top, low-severity ones at the bottom. Each finding includes the affected file/line and a link to the relevant CWE.