Pierrr Security

What it scans

Pierrr Security offers two kinds of scan, which are started and counted separately. The container scan covers every container of the project at once, the code scan reads one repository you pick when you start it.

• The container scan: the image built for each container, its system packages and the dependencies it ships, checked against published vulnerabilities.
• The code scan: the source code of one of the project's repositories, for code patterns known to be dangerous, along with the vulnerable dependencies it declares and the secrets that may have been left in it. The content of a secret is never kept.

A project's Security tab brings both kinds together on one page: a history chart per kind, the schedule of container scans, and a single list of every scan, where each row shows its kind and what it read. Each kind's usage this month is on the Billing page, and in the run dialog.

Running a scan

Open a project's Security tab and click Run a scan. A dialog asks which scan to run: a container scan, which covers every container of the project at once, or a code scan, for which you pick one repository among the project's, each shown with the container it belongs to. The first counts as one scan of your monthly container quota, the second as one scan of your monthly code quota. A kind your plan does not include, or whose monthly quota is used up, stays visible in the dialog, greyed, with the reason. The scan is queued and then starts running; the page follows its progress, and updates the counters and charts when it finishes, without you reloading it.

A scan goes through four states: queued, running, completed, failed. Every history row also shows how it was triggered, manually or on a schedule.

Scheduled scans

Rather than remembering to do it, let Pierrr come back to the project's containers at a regular interval. Schedules apply to container scans only: a code scan reads a repository you pick when you run it, so it is not scheduled. Off until you turn it on, the schedule has three settings:

• The frequency, daily or weekly.
• The day of the week, for a weekly schedule.
• The hour it runs, expressed in UTC.

An extra option emails you a summary after each scheduled scan. Those scans draw on the container quota, like the ones you start by hand.

Reading the results

The history lists every scan with its status, its trigger, its start time and the count of findings per severity. Open one for the detail, one row per finding:

• The severity: critical, high, medium or low.
• The container it affects, so you can place the finding in a project that has several.
• A description of the finding and, for a dependency vulnerability, the package at fault.
• The installed version and the fixed version, when the scanner knows of one.
• A link to the original security advisory, so you can judge the real impact on your application.

In the list of scans, a code scan shows which repository it read, and its results table adds the file concerned and the type of finding: code flaw, dependency or secret.

A selector narrows the list to a single container, and a search field filters on the vulnerability identifier, the package name, the version or the container. A counter shows how many rows matched out of the total.

Every completed scan can be downloaded as a PDF, to archive it or hand it to someone without console access.

How long results are kept

A scan and its findings are kept for 30 days, then deleted automatically. Download the PDF if you need a record beyond that.

Available plans

Pierrr Security is included from the Pro plan, for both kinds. Free and Starter organizations see an upgrade prompt instead of the scan controls.

The quotas are monthly, separate for each kind, and reset each month: 10 container scans and 10 code scans on the Pro plan, 50 and 50 on Business. Only scans that run to completion count against them, incomplete ones included (some containers or repositories could not be read); a failed scan costs you nothing.