Scan Your Source Code
Guides
Contact SupportTry JFrog
  1. source-code
  2. Developers
  3. CLI

Scan Your Source Code

The jf audit command enables developers to perform on-demand security scans of their source code directly from their terminal, ensuring early detection of CVEs, licenses, operational risk, SAST, misconfigurations, and exposed secrets. By integrating seamlessly into the developer workflow, it helps catch security risks before code reaches production—reducing remediation costs and enhancing software integrity. The scan results are displayed in the terminal for immediate feedback and are also available in the JFrog Platform’s On-Demand Scans pane, providing centralized visibility.

📘

For SCA, the command automatically detects the package manager used by your project and uses it to construct the dependency graph.

If the project hasn’t been installed yet, the system will execute an install command to generate the dependency tree for scanning.

On-demand scan results are retained for seven days before being automatically deleted.

By default, the environment variable ENABLE_CUSTOM_SECRETS_SCANNER is set to true, enabling custom secrets scanning automatically as part of the audit.

By default, the environment variable JF_SAST_DEFAULT_SCAN_MODE is set to codebase. Possible values are codebase, directory, and file. Use directory or file to improve SAST scan performance on large repositories.

🐸

Learn more about Configuration and Audit of Security Processes at JFrog Academy!

Command Options

Command: jf audit (alias: jf aud)

OptionRequiredDefaultDescription
--add-sast-rulesNo—Incorporate any additional SAST rules (in JSON format, with absolute path) into this local scan
--cocoapodsNofalseAudits a Cocoapods project.
--dep-typeNoall (npm only)Defines npm dependency types: all, devOnly, prodOnly.
--exclude-test-depsNofalse (Gradle only)Excludes Gradle test dependencies from Xray scanning.
--exclusionsNo.git, node_modules, target, venv, test, and distSemicolon-separated list to exclude specific directories. Supports wildcards (*, ?). You may override the default exclusions by explicitly setting your own list using the --exclusions flag.
--extended-tableNofalseWhen set to true, result table includes extended fields such as CVSS and Xray Issue Id. Must be executed with --format table.
--failNotrueReturns exit code 3 if a Fail Build rule is matched. Set to false to return exit code 0 with violations.
--fixable-onlyNo—Displays only issues with available fixes.
--formatNotableDefines the output format: table , json, cyclonedx, simple-json, or sarif. The json format does not support the Advanced Security contextual analysis, Secrets, and misconfiguration scans.
--goNofalseAudits a Go project.
--gradleNofalseAudits a Gradle project.
--helpNo—Displays information about the jf audit command options.
--iacNofalseSelective scanners mode Executes Infrastructure as Code (IaC) scans. Can be combined with --sca, --secrets, and --sast.
--insecure-tlsNofalseSet to true to skip TLS certificates verification.
--licensesNofalseDisplays the list of licenses.
--max-tree-depthNoInfinity (pnpm only)[pnpm] Max depth of the generated dependencies tree for the SCA scan.
--min-severityNo—Minimum severity of issues to display: Low, Medium, High, Critical.
--mvnNofalseAudits a Maven project.Note: The command requires a virtual repository that contains both your release and snapshot repositories.If this solution does not resolve the issue in your environment, please contact JFrog Support for further assistance.
--npmNofalseAudits an npm project.
--nugetNofalseAudits a .NET project.
--pipNofalseAudits a Pip project.
--pipenvNofalseAudits a Pipenv project.
--pnpmNofalseAudits a pnpm project.
--poetryNofalseAudits a Poetry project.
--projectNo—JFrog project key to identify security violations. Incompatible with --repo-path and --watches.
--repo-pathNo—Artifactory repository path for identifying violations. Incompatible with --project and --watches.
--requirements-fileNo— (Pip only)Specifies the pip requirements file (e.g., requirements.txt).
--sbomNofalseDisplays the Software Bill of Materials (SBOM) for the project when set to true. Only applicable if the --sca flag is also used and the output format is set to table. Supported formats: table and cyclonedx.
--scaNofalseSelective scanners mode Runs the Software Composition Analysis (SCA) scan. Can be combined with --secrets, --sast, and --iac.
--sastNofalseSelective scanners mode Executes Static Application Security Testing (SAST) scans. Can be combined with --sca, --secrets, and --iac.
--secretsNofalseSelective scanners mode Executes Secrets Detection scans. Can be combined with --sca, --sast, and --iac.
--server-idNoDefault serverJFrog server ID configured via jf c add.
--swiftNofalseAudits a Swift project.
--threadsNo3Number of parallel threads for scanning.
--use-wrapperNofalse (Gradle/Maven only)Use Gradle or Maven wrapper.
--validate-secretsNofalseSelective scanners mode Validates detected secrets. Only applicable when using --secrets.
--vulnNo—Displays all vulnerabilities, regardless of Xray policies.
--watchesNo—Comma-separated list of Xray watches to determine violations. Supported violations are CVEs, operational risk, and Licenses. Incompatible with --project and --repo-path.
--without-contextual-analysisNofalseSelective scanners mode Disables Contextual Analysis when using --sca.
--working-dirsNoRoot directoryComma-separated list of directories to audit. Defaults to recursive scan from the project root.
--yarnNofalseAudits a Yarn project.
--use-included-buildsNofalseSet to true to include composite (included) builds of Gradle projects in addition to their subprojects.
--urlNofalseSpecifies the URL of the JFrog platform
--xray-urlNofalseSpecifies the URL of your Xray server
--userNofalseSpecifies the user name
--passwordNofalseSpecifies the user password
--access-tokenNofalseSpecifies the JFrog platform access token

Working in Air-Gapped Environments?

Follow the Working in Air-Gapped Environments procedure.

Examples

A basic audit that shows all vulnerabilities, regardless of the policies set in Xray:

jf audit

Audit for Maven & npm projects that shows all vulnerabilities, regardless of the policies set in Xray:

jf audit --mvn --npm

Audit using a defined Watch in Xray:

jf audit --watches "watch1"

Audit using numerous defined Watches in Xray:

jf audit --watches "watch1,watch2"

Audit using defined policies in a specific project:

jf audit --project "project-1"

Audit using defined policies in a specific Artifactory path:

jf audit --repo-path "libs-local/release-artifacts/"

Excluding from audit all files inside a directory (node_modules) and files with a specific suffix (to_exclude):

jf audit --exclusions "*node_modules*;*to_exclude"

Updated 20 days ago

Did this page help you?