### Run interactive setup wizard

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

Starts the guided configuration wizard. It asks about the target and writes a profile YAML, a ready-to-run command line, or both. Only relevant questions are asked, and every question has a default, so pressing Enter throughout still produces a working configuration.

```bash
xy-dast interactive
```

--------------------------------

### Install xy-dast on Windows with PowerShell

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

One-command installer for Windows. The first command installs the wrapper; the second shows how to download and run the script to pass parameters. Installs into `$HOME\.local\bin` unless `-InstallDir` says otherwise.

```powershell
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 | iex

# `iex` cannot pass parameters. To use any, download the script and run the file:
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 -OutFile get-dast.ps1
.\get-dast.ps1 -InstallDir C:\Tools\bin -AddToPath
```

--------------------------------

### Install and run DAST on Windows

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Downloads and installs the DAST scanner via PowerShell, then runs the interactive setup. The installer verifies the signature and pins the wrapper to the verified digest.

```powershell
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 | iex
xy-dast interactive
```

--------------------------------

### Install and run DAST on Linux/macOS

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Downloads and installs the DAST scanner via curl, then runs the interactive setup. The installer verifies the signature and pins the wrapper to the verified digest.

```bash
curl -fsSL https://get.xygeni.io/latest/dast/get-dast.sh | sh   # install, signature-verified
xy-dast interactive                                            # answer a few questions
```

--------------------------------

### Install xy-dast wrapper (Linux/macOS)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Runs the Docker image's install subcommand to drop the wrapper and sidecar into ~/.local/bin.

```bash
docker run --rm -v ~/.local/bin:/mnt/install xygeni/xy-dast install
```

--------------------------------

### Run get-xygeni.sh installer (macOS/Linux)

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-installation

Executes the bootstrap script. By default it installs to ~/.xygeni, or you can pass a custom directory as an argument.

```bash
# Default installs to ~/.xygeni, or pass a custom directory
sh get-xygeni.sh [install_dir]
```

--------------------------------

### Install xy-dast on Linux/macOS with curl

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

One-command installer for Linux/macOS. The first command installs the wrapper; the second shows how to pass options through the pipe using `-s --`. Installs into the first writable of `$HOME/.local/bin` or a `$HOME/bin` already on your PATH, falling back to `$HOME/.local/bin`.

```bash
curl -fsSL https://get.xygeni.io/latest/dast/get-dast.sh | sh

# To pass options through the pipe, separate them with `-s --`:
curl -fsSL https://get.xygeni.io/latest/dast/get-dast.sh | sh -s -- -d /usr/local/bin --add-to-path
```

--------------------------------

### Create install directory and add to PATH (Linux)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Creates ~/.local/bin and ensures it is on PATH for the current and future shells. The directory must exist before the install command to avoid permission issues.

```bash
# 1. Create the directory (idempotent)
mkdir -p ~/.local/bin

# 2. Make sure it is on PATH for the current shell
case ":$PATH:" in *":$HOME/.local/bin:"*) ;; *) export PATH="$HOME/.local/bin:$PATH" ;; esac

# 3. Persist for future shells (only needed once per shell rc)
grep -q '\.local/bin' ~/.bashrc 2>/dev/null \
  || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
# zsh users: replace ~/.bashrc with ~/.zshrc
```

--------------------------------

### xygeni quality duplication examples

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-scanner-reference

Three example commands showing how to use the duplication options: one with upload and report, one with clone types and minimum tokens, and one as a CI/CD gate.

```bash
# Quality scan with upload, keeping the duplication report locally
xygeni quality -d . -n MyProject --upload --duplication-report /tmp/duplication

# Exact copies only, at least 300 tokens
xygeni quality -d . --duplication-clone-types identical --duplication-min-tokens 300

# Use duplication as a CI/CD gate
xygeni quality -d . --fail-on-duplication-ratio 15
```

--------------------------------

### Combining tech base and intensity examples

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner/dast-scanner-configuration

Three example commands showing different combinations of tech base and intensity, including a deep API scan, a quick SPA smoke test, and a production-safe passive scan.

```bash
xy-dast scan -u https://api.example.com --profile openapi --intensity deep    # deep API scan (CVE + deep crawl on)
xy-dast scan -u https://app.example.com --profile spa      --intensity quick   # fast SPA smoke test
xy-dast scan -u https://prod.example.com --profile traditional --intensity passive  # production-safe: no active payloads
```

--------------------------------

### Install SALT CLI (Linux/macOS)

Source: https://docs.xygeni.io/xygeni-products/build-security

Downloads and installs the SALT command-line tool. The commands work under Linux/macOS. Replace PATH_TO_DIR with the directory where the tool will be uncompressed.

```bash
# download zipfile
curl -sLO https://get.xygeni.io/latest/salt/salt.zip
# unzip in current directory
unzip salt.zip -d PATH_TO_DIR
# add alias
alias salt="PATH_TO_DIR/xygeni_salt/salt"
```

--------------------------------

### Example of dependency with two frameworks

Source: https://docs.xygeni.io/xygeni-products/open-source-security-oss/dependency-scanner/dependency-analyzers

Example output showing how a dependency appears twice when it is on two frameworks, once per framework.

```text
.NETFramework 4.6:Microsoft.Build.Tasks.Git:1.0.0
.NETStandard 2.0:Microsoft.Build.Tasks.Git:1.0.0
```

--------------------------------

### BitBucket Pipelines: Install and run Xygeni scanner using installation script

Source: https://docs.xygeni.io/xygeni-administration/platform-administration/integrations/integrate-scanner-cli-into-ci-cd-systems/bitbucket-integration

Use this pipeline configuration to install the scanner via the bootstrap script and run a scan. The script downloads the scanner, verifies its SHA-256 checksum, and unpacks it into $HOME/.xygeni. Requires Java 17 or higher and the XYGENI_TOKEN environment variable.

```yaml
pipelines:
  default:
    - parallel:
      - step:
          name: 'Install & run Xygeni scanner'
          script:
            - >
              curl -sSfL -o get-xygeni.sh https://get.xygeni.io/latest/scanner/get-xygeni.sh &&
              curl -sSfL -o get-xygeni.sh.sha256 https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/get-xygeni.sh.sha256 &&
              echo "$(cat get-xygeni.sh.sha256)  get-xygeni.sh" | sha256sum -c - &&
              bash get-xygeni.sh
            - $HOME/.xygeni/xygeni scan -n $PROJECT_NAME --dir $PROJECT_HOME
```

--------------------------------

### Verify installer checksum on Windows

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

Downloads the installer script and its SHA256 checksum from the GitHub repository, verifies the checksum, then runs the installer. The digest lives in a different place from the script it vouches for, so an attacker would have to compromise both `get.xygeni.io` and the GitHub repository to pass this check.

```powershell
iwr -useb https://get.xygeni.io/latest/dast/get-dast.ps1 -OutFile get-dast.ps1
$h = (iwr -useb https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/get-dast.ps1.sha256).Content.Trim()
(Get-FileHash .\get-dast.ps1 -Algorithm SHA256).Hash -eq $h.ToUpper()
.\get-dast.ps1
```

--------------------------------

### Install xy-dast wrapper (Windows PowerShell)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Runs the Docker image's install subcommand with --powershell to produce the signed .ps1 wrapper.

```powershell
docker run --rm -v "${HOME}\.local\bin:/mnt/install" xygeni/xy-dast install --powershell
```

--------------------------------

### Verify installer checksum on Linux/macOS

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

Downloads the installer script and its SHA256 checksum from the GitHub repository, verifies the checksum, then runs the installer. The digest lives in a different place from the script it vouches for, so an attacker would have to compromise both `get.xygeni.io` and the GitHub repository to pass this check.

```bash
curl -fsSLO https://get.xygeni.io/latest/dast/get-dast.sh
h=$(curl -fsS https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/get-dast.sh.sha256)
echo "$h get-dast.sh" | sha256sum -c
sh ./get-dast.sh
```

--------------------------------

### .env file for Xygeni scanner quickstart

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-docker-image

Provides environment variables for the docker-compose quickstart: PATH_TO_SCAN and PROJECT_NAME. Edit these values to customize volume paths or project name.

```plaintext
PATH_TO_SCAN=...
PROJECT_NAME=...
```

--------------------------------

### xygeni -cop examples for configuration options

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-scanner-reference

Examples of using the -cop/--conf-option global option to set configuration properties. Includes disabling commit resolution, setting parallel mode, disabling timeout, complex cases with report formatting, and using environment variables.

```bash
# Disable commit resolution
xygeni -cop 'commitResolution:never' scan ...
# Set parallel mode with two threads
xygeni -cop 'mode:parallel' -cop 'parallelism:2' secrets ...
# Disable timeout
xygeni -cop 'timeout:0' secrets ...

# More complex cases (using long or short option names):
xygeni --config-option "report[format=text]/sort: exposure" \
  --config-option "report[format=text]/borders: none" \
  --config-option "parallelism: min(availableProcessors - 1, 4)" \
  scan ...
  
# Imagine that the user has this environment var instead of the expected JENKINS_URL
xygeni -cop "cicd[kind=jenkins]/url: ${MY_JENKINS_URL}" misconf ...
```

--------------------------------

### Examples of setting configuration options via command line

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-configuration-options

Provides multiple examples of using -cop/--conf-option to set various configuration properties, including disabling commit resolution, setting parallel mode, disabling timeout, and using complex values with report formatting and environment variables.

```bash
# Disable commit resolution
xygeni -cop 'commitResolution:never' scan ...
# Set parallel mode with two threads
xygeni -cop 'mode:parallel' -cop 'parallelism:2' secrets ...
# Disable timeout
xygeni -cop 'timeout:0' secrets ...

# More complex cases (using long or short option names):
xygeni --config-option "report[format=text]/sort: exposure" \
  --config-option "report[format=text]/borders: none" \
  --config-option "parallelism: min(availableProcessors - 1, 4)" \
  scan ...

# Imagine that the user has this environment var instead of the expected JENKINS_URL
xygeni -cop "cicd[kind=jenkins]/url: ${MY_JENKINS_URL}" misconf ...
```

--------------------------------

### Verify xy-dast installation

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Checks that the wrapper is installed and accessible. If command not found, revisit Step 1.

```bash
xy-dast --version
```

--------------------------------

### Run the Xygeni installer script

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-installation

Runs the PowerShell installer script. By default installs to $Home\.xygeni, or you can pass -Dir to specify a custom directory.

```powershell
.\get-xygeni.ps1 [-Dir C:\path\to\install]
```

--------------------------------

### Get help for attestation subcommands

Source: https://docs.xygeni.io/xygeni-products/build-security/salt-command-line-reference

Shows the help output for the attestation subcommands init, add, run, and commit. Use the -h or --help option to get full command syntax for each subcommand.

```bash
salt attestation init -h
salt attestation add -h
salt attestation run -h
salt attestation commit -h
```

--------------------------------

### Run Salt installation script (PowerShell)

Source: https://docs.xygeni.io/xygeni-products/build-security/installing-salt-cli

Runs the Salt installation script on Windows. Defaults to $Home\.salt, or specify a directory with -Dir.

```powershell
# Default installs to $Home\.salt, or pass -Dir
.\get-salt.ps1 [-Dir C:\path\to\install]
```

--------------------------------

### Example airgap-allowlist.txt

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/airgapped-scanning

Example contents of conf/airgap-allowlist.txt for filtered mode. One host per line, supports *.suffix wildcards, blank lines and # comments ignored, matching is case-insensitive. An empty or missing file blocks everything.

```plaintext
# conf/airgap-allowlist.txt
registry.npmjs.org
search.maven.org
*.github.com
artifactory.internal
```

--------------------------------

### Install pre-commit hooks: pre-commit install

Source: https://docs.xygeni.io/platform-administration/integrations/git-hooks-with-xygeni

Installs the git hook scripts after configuring .pre-commit-config.yaml. Comments show how to test the configuration with pre-commit try-repo or pre-commit run.

```bash
# You may test the hook configuration with
#   pre-commit try-repo or pre-commit run
pre-commit install

```

--------------------------------

### Profile schema YAML example

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner/dast-scanner-configuration

A complete YAML profile example showing all sections: identity, scope, authentication, users, session, technology, spider, and AJAX spider. Includes comments explaining each field.

```yaml
# Identity
name: my-profile
description: "Description of the profile"
extends: openapi  # Optional: inherit from a base profile

# Scope - URL patterns to include/exclude
scope:
  includePatterns:
    - "https://api.example.com/v2/.*"
  excludePatterns:
    - ".*logout.*"
    - ".*\.js$"
    - ".*\.css$"

# Authentication (see "Authentication Configuration" below for every method)
authentication:
  method: BEARER            # NONE, FORM, BEARER, HEADER, BASIC, JSON, OAUTH2, SCRIPT
  loginUrl: ""              # Login form URL (for FORM method)
  usernameField: "username" # Form field name for username
  passwordField: "password" # Form field name for password
  headerName: "Authorization"  # Header name (for BEARER/HEADER)
  headerValue: "${env:API_TOKEN}"  # Header value
  headerPrefix: "Bearer "   # Header value prefix

# Users (for form-based authentication)
users:
  - name: "test-user"
    username: "admin"
    password: "admin123"
    default: true

# Session management
session:
  method: COOKIE  # COOKIE, HEADER, or SCRIPT
  # import:       # Pre-authenticated session import (SSO) — see below
  #   cookies: [...]
  #   headers: [...]

# Technology context (helps optimize scanning)
technology:
  language: javascript
  database: mysql
  framework: express
  include:
    - "Db / MySQL"
    - "Language / JavaScript"

# Spider configuration
# Durations: a positive value caps the phase; 0 means UNLIMITED (no timeout), never "skip".
# To disable a phase, set its `skip: true` (or use the matching --skip-* CLI flag).
spider:
  duration: 10   # Maximum duration in minutes (0 = unlimited)
  depth: 5       # Maximum crawl depth
  children: 10   # Maximum children per node
  skip: false    # Set to true to disable the spider

# AJAX Spider configuration (for SPAs)
ajaxSpider:
  duration: 15   # Maximum duration in minutes (0 = unlimited)
  depth: 5       # Maximum crawl depth
  browsers: 4    # Number of browser instances
  skip: false    # Set to true to disable AJAX spider
```

--------------------------------

### Inventory scan output example

Source: https://docs.xygeni.io/xygeni-products/application-security-posture-management-aspm/inventory-scanner

Example output from the inventory command showing discovered assets and a warning about the uploaded report.

```text
Assets found: 69
┌───────────────────┬─────────────────────────────┬───────────────────────────────────┬────┐
│       Kind        │Name                         │Belongs To                         │Tags│
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│     code_repo     │myorg/ProductXYZ             │                                   │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   cicd_pipeline   │clean-packages               │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   cicd_pipeline   │codeql-analysis              │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   cicd_pipeline   │deploy-maven                 │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│ ...
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   dependencies    │docs                         │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   security_tool   │CodeQL                       │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│cloud_configuration│deployment/docker/Dockerfile │code_repo:github:myorg/ProductXYZ  │    │
├───────────────────┼─────────────────────────────┼───────────────────────────────────┼────┤
│   organization    │myorg                        │                                   │    │
└───────────────────┴─────────────────────────────┴───────────────────────────────────┴────┘

2023-03-28 18:30:26 [main] WARN InventoryCommand - report uploaded with analysis code: AN-demo@myorg-184
```

--------------------------------

### Create install directory and add to PATH (Windows PowerShell)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Creates the install directory and adds it to the user PATH, persisting for future shells without admin rights.

```powershell
# 1. Create the directory
New-Item -ItemType Directory -Force -Path "$HOME\.local\bin" | Out-Null

# 2. Add to PATH for the current shell
$env:PATH = "$HOME\.local\bin;$env:PATH"

# 3. Persist for future shells (User scope, no admin needed)
$userPath = [Environment]::GetEnvironmentVariable('PATH', 'User')
if ($userPath -notlike "*$HOME\.local\bin*") {
  [Environment]::SetEnvironmentVariable('PATH', "$HOME\.local\bin;$userPath", 'User')
}
```

--------------------------------

### Install salt command autocompletion

Source: https://docs.xygeni.io/xygeni-products/build-security/salt-how-to...

Installs command-line completion for the salt command (Bash or ZSH shells).

```bash
source <(salt generate-completion)
```

--------------------------------

### Install Xygeni scanner using get-xygeni.sh and run scan

Source: https://docs.xygeni.io/xygeni-administration/platform-administration/integrations/integrate-scanner-cli-into-ci-cd-systems/circleci-integration

CircleCI job configuration that installs the scanner via the bootstrap script and runs a scan. Requires Java 17 or higher and the XYGENI_TOKEN environment variable. The script downloads the scanner, verifies its SHA-256 checksum, and unpacks it into $HOME/.xygeni.

```yaml
jobs:
  build:
    steps:
      - run:
        name: Install Xygeni scanner
        command: >
          curl -sSfL -o get-xygeni.sh https://get.xygeni.io/latest/scanner/get-xygeni.sh &&
          curl -sSfL -o get-xygeni.sh.sha256 https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/get-xygeni.sh.sha256 &&
          echo "$(cat get-xygeni.sh.sha256)  get-xygeni.sh" | sha256sum -c - &&
          bash get-xygeni.sh

      - run:
        name: Scan for issues
        command: >
          $HOME/.xygeni/xygeni scan
            -n $PROJECT_NAME
            --dir $PROJECT_HOME

```

--------------------------------

### Create install directory and add to PATH (macOS)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Creates ~/.local/bin and adds it to PATH for the current and future shells, using ~/.zshrc as the default shell rc file.

```bash
# 1. Create the directory
mkdir -p ~/.local/bin

# 2. Add to PATH for the current shell
export PATH="$HOME/.local/bin:$PATH"

# 3. Persist for future shells (zsh is the default since macOS Catalina)
grep -q '\.local/bin' ~/.zshrc 2>/dev/null \
  || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.zshrc
# bash users: replace ~/.zshrc with ~/.bash_profile
```

--------------------------------

### Run first scan with docker compose up

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-docker-image

Starts the Xygeni scanner container defined in docker-compose.yml. By default, a full scan is performed.

```bash
docker compose up
```

--------------------------------

### Verify PATH (Linux)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Checks that the install directory is on PATH. Should print the path.

```bash
echo "$PATH" | tr ':' '\n' | grep -F "$HOME/.local/bin"   # should print the path
```

--------------------------------

### Verify PATH (macOS)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-dast

Checks that the install directory is on PATH. Should print the path.

```bash
echo "$PATH" | tr ':' '\n' | grep -F "$HOME/.local/bin"
```

--------------------------------

### Prisma Cloud alerts with open/severity/cloud/time filters and RQL example

Source: https://docs.xygeni.io/xygeni-products/application-security-posture-management-aspm/importing-reports-from-3rd-party-tools/pull-mode-fetch

Runs Prisma Cloud alerts pulldown with filters: `status=open`, comma-separated `severity=critical,high`, comma-separated `cloud=aws,azure`, and `time_range_days=7`. Also shows a raw RQL filter example inline: `--filter rql="config from cloud.resource where finding.type = 'CVE'"`.

```bash
xygeni report-upload --pull -f iac-prisma-cloud \
  --filter status=open \
  --filter severity=critical,high \
  --filter cloud=aws,azure \
  --filter time_range_days=7

```

--------------------------------

### Run Salt CLI bootstrap script (macOS/Linux)

Source: https://docs.xygeni.io/xygeni-products/build-security/installing-salt-cli

Runs the Salt CLI bootstrap script. By default it installs to ~/.salt, or you can pass a custom directory as an argument.

```bash
# Default installs to ~/.salt, or pass a custom directory
sh get-salt.sh [install_dir]
```

--------------------------------

### pipgrip command to get dependency tree

Source: https://docs.xygeni.io/xygeni-products/open-source-security-oss/dependency-scanner/dependency-analyzers

Command executed by the Pip analyzer to get the dependency tree. Requires pipgrip and pip to be installed.

```bash
pipgrip --tree --json
```

--------------------------------

### Retrieve secret with AWS SDK for Go

Source: https://docs.xygeni.io/xygeni-products/secrets-security/secret-leaks-handling/how-to-prevent-hard-coded-secrets

Uses the AWS SDK for Go v2 to get a secret value from AWS Secrets Manager. Requires the github.com/aws/aws-sdk-go-v2 packages. The example shows loading config and calling GetSecretValue.

```go
import (
	"context"
	"encoding/json"
	"fmt"
	"log"

	"github.com/aws/aws-sdk-go-v2/aws"
	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
)

cfg, err := config.LoadDefaultConfig(context.TODO(), config.WithRegion(your_region))
if err != nil { ... }
client := secretsmanager.NewFromConfig(cfg)
input := &secretsmanager.GetSecretValueInput{ SecretId: aws.String(secretName), }
result, err := svc.GetSecretValue(input)
if err != nil { ... }
secret := *result.SecretString
```

--------------------------------

### Retrieve secret with .NET AWS SDK (C#)

Source: https://docs.xygeni.io/xygeni-products/secrets-security/secret-leaks-handling/how-to-prevent-hard-coded-secrets

Uses the .NET AWS SDK with the caching extension to get a secret value from AWS Secrets Manager. The example shows a helper method that retrieves the secret using the AWSCURRENT version stage.

```csharp
using Amazon.SecretsManager.Extensions.Caching;

var client = new AmazonSecretsManagerClient();
var response = await GetSecretAsync(client, "SECRET");
if (response is not null && response.SecretString is not null)
{
    string secret = response.SecretString;
}
...

private static async Task<GetSecretValueResponse>
  GetSecretAsync( IAmazonSecretsManager client, string secretName )
{
    var request = new GetSecretValueRequest()
    {
        SecretId = secretName,
        VersionStage = "AWSCURRENT", // the default
    };

    return await client.GetSecretValueAsync(request);
}
```

--------------------------------

### Full reference of conf/xygeni.yml

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/scm-ci-cd-and-container-registry-tokens

Full reference configuration for conf/xygeni.yml, showing the scm section with a GitHub example. This is the complete reference for configuring SCM systems.

```yaml
# List of different Source Code Management (SCM) systems
# supporting projects for the organization
scm:
  # One of: github, azure_devops, bitbucket, gitlab.
  -
    kind: github
    # Which projects are held in this SCM?
    # Use a regex pattern, like 'project1|project2|project3' or 'prefix_.*'
    # Leave empty for matching any project for the given scm kind)
    usedBy: ${GITHUB_USED_BY}
    # The (optional) default username to connect to the SCM API.
    # If not given it could be extracted from the repository URL, when available.
    user: ${GITHUB_USER}
    # How the access token should be fetched:

```

--------------------------------

### Install Git hooks with core.hooksPath

Source: https://docs.xygeni.io/platform-administration/integrations/git-hooks-with-xygeni

Sets the Git hooks path to ./dev/hooks if not already configured. Requires git >= 2.9 and assumes hooks are stored in ./dev/hooks.

```bash
install_hooks() {
  git config core.hooksPath \
    || git config core.hooksPath ./dev/hooks
}
```

--------------------------------

### Attestation drafting workflow with salt attestation commands

Source: https://docs.xygeni.io/xygeni-products/build-security/salt-command-line-reference

Complete attestation drafting workflow: init creates the draft with git and environment attestors, add adds materials/products/predicates, run captures a build step (go install), and commit signs and publishes. Use CI/CD variables for a unique --pipeline value, e.g. $GITHUB_WORKFLOW_REF/$GITHUB_RUN_ID in GitHub Actions.

```bash
# Initialize attestation
salt -nb attestation init -p $PIPELINE -d $REPO_DIR \
     --attestor git --attestor environment

# Add material (src directory) and products
# (command-line executable tool built, and OCI image)
salt -nb attestation add -p $PIPELINE -d $REPO_DIR \
     --type material --file src
     --type product --file path/to/cli_tool  \
     --type product --image myorg/my_image:my_tag

# Add an attestation predicate,
# for example issues from your favorite Xygeni scan
# in the in-toto Vulnerabilities predicate format:
salt -nb attestatation add -p $PIPELINE -d $REPO_DIR \
     -n xygeni-scan -t predicate -f path/to/xygeni_scan.json \
     --predicate-type https://in-toto.io/attestation/vulns

# Capture a build step to be included in the attestation
# In the example the current Go package is built and installed:
salt -nb attestation run -p $PIPELINE -d $REPO_DIR \
     --step compile -- \
     go install

# ... more attestation add commands may follow ...

salt -nb attestation commit -p $PIPELINE -d $REPO_DIR \
     -k env:MY_KEY -kpass env:MY_KEY_PASS -pk env:MY_PUB \
     -o attestation.json --output-unsigned
```

--------------------------------

### Install unzip (Linux)

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-cli

Installs the unzip command if it is not available on your system.

```bash
sudo apt install unzip
```

--------------------------------

### salt attestation --help

Source: https://docs.xygeni.io/xygeni-products/build-security/salt-command-line-reference

Shows the help output for the `salt attestation` command, listing its options and subcommands. The command creates software attestations following the in-toto Attestations Framework, either incrementally (init/add/run/commit/reset) or in one shot with `provenance`/`slsa`. The `--never-fail` option defaults to false, and the config file defaults to `$HOME/.salt/salt.yaml` or `$SALT_HOME/conf/salt.yaml`.

```bash
$ salt attestation --help

Usage: salt attestation [-hV] [--never-fail] [--config=<config>] -p=<pipeline>
                        [@<filename>...] CMD

Create software attestation: incrementally using init / add / run / commit|reset, or SLSA
build provenance in a single shot.

      [@<filename>...]    One or more argument files containing options.
  -p, --pipeline=<pipeline>
                          name of the pipeline/workflow being run.
      --never-fail        Always return 0, even with errors, to keep the pipeline
                            running. Default: false
  -h, --help              Show this help message and exit.
  -V, --version           Print version information and exit.
      --config=<config>   config file (default $HOME/.salt/salt.yaml or
                            $SALT_HOME/conf/salt.yaml)

Commands:
  init              start attestation drafting process
  run               run a command and add attestation for the command execution
  add               add element (material, subject, product or statement) to draft
                      attestation
  status            show the current draft attestation
  commit            complete and store the attestation in draft
  reset             reset attestation in draft
  provenance, slsa  generate and sign SLSA provenance
```

--------------------------------

### Npm: Generate yarn.lock with yarn install

Source: https://docs.xygeni.io/xygeni-products/open-source-security-oss/dependency-scanner/dependency-analyzers

When no lock file is found, the analyzer generates a yarn.lock file in a temporary directory by running this command. Requires yarn; if not installed, the analyzer tries to install it.

```bash
yarn install --ignore-scripts --modules-folder ${TEMPDIR}/node_modules
```

--------------------------------

### Full project configuration example

Source: https://docs.xygeni.io/xygeni-products/api-security/api-security-scanner/api-security-scanner-configuration

A complete project configuration that disables autodiscovery, pins frameworks, tightens sensitive-data detectors, suppresses a known-public field, and disables rate_limit_absence. Run with the provided CLI command.

```yaml
autodiscovery:
  enabled: no

frameworks:
  enabled:
    - spring-mvc
    - openapi
  disabled: []

detectors:
  excessive_data_exposure_java:
    enabled: yes
    properties:
      minConfidence: high
  pii_leak_in_response_java:
    enabled: yes
    severity: high
  jwt_misconfiguration:
    enabled: yes
  mass_assignment:
    enabled: yes
    properties:
      protectedAttributes:
        - admin
        - role
        - isAdmin
        - balance
        - tenantId          # project-specific privileged field
  rate_limit_absence:
    enabled: no             # gateway-level limits are in place

sensitivityClassifier:
  ignore:
    - com.acme.user.NewsletterSubscriber#email
```

```bash
xygeni apisecurity --dir . -c xygeni.apisecurity.yml -f json -o report.json --fail-on high
```

--------------------------------

### Display scanner help reference

Source: https://docs.xygeni.io/xygeni-products/software-supply-chain-security-sscs/ci-cd-scanner

Shows all available command-line options for the misconfiguration scanner.

```bash
xygeni misconf --help
```

--------------------------------

### Composer commands to get dependencies and tree

Source: https://docs.xygeni.io/xygeni-products/open-source-security-oss/dependency-scanner/dependency-analyzers

Commands executed by the Composer analyzer to get all dependencies with resolved versions and the dependency tree.

```bash
# To get all dependencies with resolved version
composer show -f json

# To get the dependency tree
composer show -t -f json
```

--------------------------------

### Post-quantum cryptography CLI examples

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-scanner-reference

Shows five Xygeni CLI commands for cryptographic inventory, compliance, readiness, single-pass scan, and org-scan with CBOM output. Use these to generate CBOM files, run compliance checks, and produce readiness reports.

```bash
# Cryptographic inventory (CBOM), written to a file
xygeni inventory --cbom --cbom-file cbom.json

# Compliance against a post-quantum standard, ingesting a CBOM
xygeni compliance -s nist_pqc_transition --cbom-file cbom.json

# Supply-chain post-quantum readiness report
xygeni deps --pqc-readiness pqc-readiness.md

# Inventory + compliance in a single pass (discovered once, reused; no file needed)
xygeni scan --cbom -s nist_pqc_transition

# One CBOM document per repository, across a whole organization
xygeni org-scan --org my-org --run inventory --cbom --cbom-file cbom.json
```

--------------------------------

### Workload identity URI example

Source: https://docs.xygeni.io/xygeni-products/build-security/attestation-policy

Example of a URI that Fulcio writes into the certificate for keyless CI signing, representing the workload identity (repository, workflow, and ref).

```text
https://github.com/acme/build/.github/workflows/release.yml@refs/heads/main
```

--------------------------------

### salt keygen help output

Source: https://docs.xygeni.io/xygeni-products/build-security/salt-command-line-reference

Shows the full help output for the `salt keygen` command, including all options and examples. Use this to understand the available flags for key generation.

```bash
$ salt --no-banner keygen -h

Usage:

salt keygen [-hV] [--insecure-no-password] [-b=<bits>] [--config=<config>]
            [-d=<path>] [-f=NAME] [-t=<type>] [@<filename>...]

Generate and save signing keys to disk. These keys may be used later in
attestation commands.

Parameters:
      [@<filename>...]     One or more argument files containing options.
  -f, --file-prefix=NAME   Name for generated .key / .pub files (default: salt).
  -t, --type=<type>        key type, one of rsa, ed25519, ecdsa (default: rsa).
  -b, --bits=<bits>        key size, in bits.
                           RSA defaults to 3072. Use values between 2048 and
                             4096.
                           ECDSA curve will be P-256 up to P-521 depending on
                             bits; below 256 is refused.
                           Not applicable to Ed25519.
      --insecure-no-password
                           Write the private key with no password, in clear
                             text. Anyone who can read the file can sign as
                             you. Only for a key held somewhere that protects
                             it by other means.
  -d, --basedir=<path>     directory for key files.
                           Default is current working dir.
  -h, --help               Show this help message and exit.
  -V, --version            Print version information and exit.
      --config=<config>    config file (default $HOME/.salt/salt.yaml or
                             $SALT_HOME/conf/salt.yaml)

Examples:
  # generate key-pair and write to salt.key and salt.pub files
  salt keygen

  # generate key-pair and write to my-signer.key and my-signer.pub files
  salt keygen --file-prefix my-signer

NOTE:
  The command interactively prompts for a password.
  You may use SALT_PRIVATE_KEY_PASSWORD environment variable to provide one.
```

--------------------------------

### Run first scan with Xygeni CLI

Source: https://docs.xygeni.io/getting-started/quick-start-with-xygeni-cli

Navigate to your project directory and run the scan command. All vulnerabilities are listed with their path and fix guidance.

```bash
$ cd /my/project
$ xygeni scan 
```

--------------------------------

### Secure install: pin image digest and verify cosign signature

Source: https://docs.xygeni.io/xygeni-products/dast-security/dast-scanner

Secure install flow for production environments. Pins the xy-dast image to its immutable digest and verifies the cosign (Sigstore keyless) signature before installing. Repeat the four steps to upgrade, or run `xy-dast update` to pull, verify, and re-pin the wrapper and image together.

```bash
TAG=xygeni/xy-dast:6.7.0     # or :latest

# 1. Pull the image so the digest is in your local image cache.
docker pull "$TAG"

# 2. Verify the cosign signature, signed by the xy-dast GitHub Actions identity.
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github\.com/xygeni/xy-dast' \
  "$TAG"

# 3. Resolve the immutable digest the registry served us.
DIGEST=$(docker image inspect "$TAG" --format '{{index .RepoDigests 0}}')

# 4. Install. --image rewrites only the `image:` line in xy-dast-compose.yml
#    to pin the resolved digest — wrapper bytes stay byte-identical.
docker run --rm -v ~/.local/bin:/mnt/install "$TAG" install --image "$DIGEST"
```

--------------------------------

### GitHub token configuration in conf/xygeni.yml

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/scm-ci-cd-and-container-registry-tokens

Example configuration for GitHub SCM in conf/xygeni.yml, showing how to set usedBy, user, and tokenSources with environment variables and file paths. Token sources are tested until a valid token is found.

```yaml
kind: github
    # Which projects are held in this SCM?
    # Use a regex pattern, like 'project1|project2|project3' or 'prefix_.*'
    # Leave empty for matching any project for the given scm kind)
    usedBy: ${GITHUB_USED_BY}
    # The (optional) default username to connect to the SCM API.
    # If not given it could be extracted from the repository URL, when available.
    user: ${GITHUB_USER}
    # How the access token should be fetched:
    # From environment/system property (env:),
    # From file (use ${scanned.dir} for scanned directory, ${XYGENI_DIR} for scanner directory, ${user.home} for $HOME),
    # or encode directly (use encryption to protect the token against casual readers)
    tokenSources:
      - ${GITHUB_TOKEN}
      - ${GITHUB_PAT}
      - file:${user.home}/.github.token
      - file:${XYGENI_DIR}/conf/.github.token
```

--------------------------------

### Download Salt CLI bootstrap script (Windows)

Source: https://docs.xygeni.io/xygeni-products/build-security/installing-salt-cli

Downloads the Salt CLI bootstrap script for Windows. Run this before reviewing and executing the script.

```powershell
Invoke-WebRequest https://get.xygeni.io/latest/salt/get-salt.ps1 -OutFile get-salt.ps1
```

--------------------------------

### View help for xygeni deps command

Source: https://docs.xygeni.io/xygeni-products/open-source-security-oss/dependency-scanner

Use the `--help` flag to display all available options for the `xygeni deps` command.

```bash
xygeni deps --help
```

--------------------------------

### Guardrail Action Example with @exitcode and print_all

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/guardrails

Example guardrail action block: triggers on `secrets`, filters by `severity = 'critical'`, exits with code 167, and prints a count for non-critical items using `print_all`.

```xyflow
on secrets
  when
    severity = 'critical'
  then
    @exitcode(167)'
  else
    print_all:@print("non-critical:" + @count($))'
```

--------------------------------

### Download Salt CLI bootstrap script (macOS/Linux)

Source: https://docs.xygeni.io/xygeni-products/build-security/installing-salt-cli

Downloads the Salt CLI bootstrap script for macOS/Linux. Run this before reviewing and executing the script.

```bash
curl -sSfLO https://get.xygeni.io/latest/salt/get-salt.sh
```

--------------------------------

### Download central configuration with `xygeni util conf-download`

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/cli-utils/central-configuration

Downloads the central configuration without overwriting the local scanner configuration. Useful for verifying that the upload was successful.

```bash
xygeni util conf-download
```

--------------------------------

### xygeni inventory command usage and options

Source: https://docs.xygeni.io/xygeni-products/application-security-posture-management-aspm/inventory-scanner

Shows the full usage and parameter list for the `xygeni inventory` command. Use it to discover SDLC assets for a project. Key options include `-n` for name, `-d` for directory, `-repo` for repository, `--image` for container image, `--upload` to upload results, and `-o`/`-f` for output file and format. Results are not uploaded by default.

```text
Usage:

xygeni inventory [-huV] [-n=<name>]
  [-d=<directory>] [-e=<excludePatterns>] [-i=<includePatterns>]
  [-repo=<repo>] [--repo-branch=<repoBranch>]
  [--image=<image>] [--image-platform=<platform>]
  [--image-sources=<sources>] [--image-scope=<scope>]
  [-o=<output>] [-f=<format>] [--report-columns=<reportColumns>]
  [-c=<config>] [--[no-]conf-download]
  [--detectors=<detectors>] [--skip-detectors=<skipDetectors>]
  [--never-fail] [@<filename>...]

Discover SDLC assets for a project.

Parameters:
      [@<filename>...]       One or more argument files containing options.
  -n, --name=<name>          The software name.
  -u, --upload               Upload report to xygeni server.
  -h, --help                 Show this help message and exit.
  -V, --version              Print version information and exit.

Input files options:
  -d, --dir=<directory>      The directory to analyze (default: current directory).
  -i, --include=<includePatterns>
                             Include patterns, comma-separated (optional).
  -e, --exclude=<excludePatterns>
                             Exclude patterns, comma-separated (optional).
                             Example: '**/test/**'

Repository options:
  -repo, --repository=<repo> The repository. Either a URL or scm:owner/repo,
                             like 'github:tensorflow/tensorflow'
  --repo-branch=<ref>        The repository branch or commit SHA to checkout for analysis.
                             HEAD if unspecified.

Container image options:
      --image=<image>        The container image, in registry/repository/image:tag format.
                             Examples: debian, alpine:latest, cgr.dev/chainguard/go,
                             gcr.io/google-containers/python@sha256:fe...4b
      --image-platform=<platform>
                             The image platform in the form os/arch, if image is multi-platform.
      --image-sources=sources
                             The image source(s) to use, comma-separated in order.
                             Defaults to docker, containerd, podman, remote.
      --image-scope=<scope>  How layers are analyzed. One of merged, mergedExceptBase, byLayer,
                             byLayerExceptBase. Default: merged.

Output options:
  -o, --output=<output>      Output file. Use 'stdout' or '-' for standard output, 'stderr' for standard error.
  -f, --format=<format>      Output format: none, text, json, csv.
      --report-columns=<reportColumns>
                             Report columns, separated by commas (default:
                             config property report/columns)

Collaborators:
      --include-collaborators
                             If repository collaborators should be added to inventory.

Configuration options:
  -c, --conf=<config>        Configuration file (default: xygeni.inventory.yml).
      --[no-]conf-download   Download scanner config? (default: true}
      --detectors=<detectors>
                             Comma-separated list of IDs for detectors to run, or 'all'
      --skip-detectors=<skipDetectors>
                             Comma-separated list of IDs for detectors to ignore

Exit options:
      --never-fail           Do not fail: always exit with code 0, even with flaws or errors.

```

--------------------------------

### Review get-xygeni.sh script contents (macOS/Linux)

Source: https://docs.xygeni.io/xygeni-scanner-cli/xygeni-cli-overview/xygeni-cli-installation

Shows the full contents of the get-xygeni.sh bootstrap script. It downloads the scanner, verifies its SHA-256 checksum, and installs it to ~/.xygeni by default. The script exits if already installed and uses curl/wget and unzip/jar as available.

```bash
set -e
# Download helper: uses curl if available, falls back to wget
fetch() { curl -sSfL "$1" 2>/dev/null || wget -qO- "$1"; }
DIR="${1:-$HOME/.xygeni}"
# Check and exit if already installed
[ -x "$DIR/xygeni" ] && { echo "Xygeni scanner already installed in $DIR" >&2; exit 0; }
ZIP="$(mktemp).zip"
trap 'rm -f "$ZIP"' EXIT
# Download scanner and checksum
fetch https://get.xygeni.io/latest/scanner/xygeni_scanner.zip > "$ZIP"
EXPECT=$(fetch https://raw.githubusercontent.com/xygeni/xygeni/main/checksum/latest/xygeni-release.zip.sha256)
ACTUAL=$(sha256sum "$ZIP" 2>/dev/null || shasum -a 256 "$ZIP")
ACTUAL=$(echo "$ACTUAL" | awk '{print $1}')
# Verify checksum
[ "$EXPECT" = "$ACTUAL" ] || { echo "Checksum mismatch: expected $EXPECT, got $ACTUAL" >&2; exit 1; }
# Extract scanner: uses unzip if available, falls back to jar (Java is required for the scanner)
mkdir -p "$DIR"
unzip -qo "$ZIP" -d "$DIR" 2>/dev/null || (cd "$DIR" && jar xf "$ZIP")
mv "$DIR/xygeni_scanner"/* "$DIR/" && rmdir "$DIR/xygeni_scanner"  # flatten nested dir
echo "Xygeni scanner installed in $DIR"
```