GUIDE 10 · WEB APPLICATIONS AND APIs
Add security checks to CI/CD and GitHub Actions
Run supported checks against an approved staging release before promoting it, and monitor the published environment separately. Keep findings, incomplete coverage and technical failures distinct in the release policy. Scantelio provides a real CLI/API workflow; source auditing and automatic rollback are not implied.
Connect security checks to CI/CDSign-in, ownership verification and consent are required. Authorized scenarios, monitoring and CI require Pro or Business.
On this page
Choose the right pipeline stage
A pull request can run your chosen source and dependency tools. DAST needs a deployed application, so run approved staging scenarios after deployment and before promotion. A check started after production deployment cannot prevent that deployment. Keep environment and revision identifiers explicit.
Prepare the integration
Create a verified project and staging component, grant consent and prepare any accounts, objects and expected permissions. Check the available quota and plan. Generate a project-scoped token through the protected workspace UI and store it in CI secrets. Do not give untrusted pull-request code access to privileged credentials.
Primary sources: Primary reference 1 · Primary reference 2
Use the real CLI
Download the supplied Scantelio CLI and run-ci.sh, pin their versions and provide the documented environment variables. The script passes the project, environment, verified deployment URL and release revision and writes a JSON artifact. Node.js 22 or later is required. The local protocol checks the actual CLI against a controlled API, not a completed GitHub staging deployment.
export SCANTELIO_REVISION="$GITHUB_SHA"
bash run-ci.shWait for the actual result
An accepted request is not a completed scan. The CLI polls queued, preparing and running states, with a 100-minute wait limit and 15-second HTTP request timeouts. Use a stable idempotency key per pipeline attempt. Canceling the CI job does not automatically cancel the server-side run; check and cancel it through the workspace when necessary.
Primary sources: Primary reference 1 · Primary reference 2
Continue: IDOR and BOLA: test access to another user’s data
Connect security checks to CI/CDSet the release gate
Exit 0 means the configured gate is satisfied; 1 means blocking findings; 2 means an error or incomplete coverage under the applicable policy. Basic CI is available on Pro and Business; shared workspace policies require Business. Detection quality is not reserved for the higher plan. Do not hide failures with unconditional continue-on-error.
| CLI exit code | Meaning | Pipeline action |
|---|---|---|
| 0 | Configured gate satisfied | Allow the next step under your policy |
| 1 | Blocking confirmed finding | Stop promotion |
| 2 | Incomplete or error | Do not mark passed; investigate and retry |
Handle baselines and exceptions deliberately
A baseline distinguishes already known findings from new ones under the selected policy. Existing findings still need a rationale, owner and expiration where supported. An exception must not turn a scanner outage into a successful check. Retain the decision and the sanitized report for the tested release.
Primary sources: Primary reference 1 · Primary reference 2
Protect the pipeline itself
Use minimal permissions, trusted and pinned automation dependencies and a documented secret boundary. Do not run arbitrary external branches with deployment tokens. Save report artifacts even when the gate fails, with access and retention suitable for the data. Never print a project token in the job log.
Verify the complete release chain
On your own staging repository, deploy a candidate with one controlled supported issue, confirm the expected gate failure, fix it and deploy a new revision. Check the matching revision in the deployment, scan and artifact. Also exercise incomplete coverage and cancellation. Hosted staging acceptance is a separate owner-run step; the published local protocol states what was actually executed.
Continue: Exposed .env, .git or API keys: contain the leak and verify the fix
Reproducible examples and downloads
All example data is synthetic. Downloads contain no active keys or customer records. Run examples only in your own isolated test environment.
Example verification record: versions, actions and observations
Questions and answers
Is CI available on Pro?
Yes, under the current catalog. Shared team policy settings are a separate Business capability.
Can I gate only new findings?
Use the supported baseline and gate mode deliberately, with the required policy configuration.
What if the scanner is unavailable?
Follow the defined incomplete/error policy. Do not describe the check as passed.
Does a post-deployment scan prevent that deployment?
No. A promotion barrier must run before promotion to the target environment.
Should I use a production admin token?
Use a project-scoped token and appropriate minimal test credentials for the approved environment.
Do CI runs consume quota?
Yes. API/CI does not bypass the project and workspace accounting rules.
Editorial team and sources
Scantelio editorial team: methodology and limitations. Example verified: 2026-11-02.
Apply the check to your own project
Connect security checks to CI/CDChoose your project after signing in. No scan runs without verification and consent.