# Security posture

> The scanners that run on every collector, what blocks a release, and what each collector's security summary shows.

Every collector is scanned on every change, and its security posture is published with it: each collector’s page in the [catalogue](/collectors/catalogue/) ends with its summary. These are scanners, not agents, and nothing about them is a claim you have to take on trust: each line below says what runs and what it gates.

## When the scans run

- On every merge request.
- On every change to the default branch.
- On every release tag.
- **Weekly**, on Sunday at 03:00 UTC, so a newly published vulnerability in a dependency that has not changed is still found.

## What is scanned

| Check             | Tool                                                                                                                                                                                                                                                | Gate                                        |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
| Secrets           | gitleaks, over the repository’s full history                                                                                                                                                                                                        | Any finding fails                           |
| Static analysis   | Semgrep and Bandit, per collector                                                                                                                                                                                                                   | A high or critical finding blocks a release |
| Dependencies      | pip-audit and OSV-Scanner, on the collector’s resolved dependencies                                                                                                                                                                                 | A high or critical finding blocks a release |
| Bill of materials | CycloneDX                                                                                                                                                                                                                                           | Produced for every collector                |
| Licences          | A licence check against an allow-list: MIT, BSD, Apache-2.0, ISC, PSF and MPL-2.0                                                                                                                                                                   | Anything else fails                         |
| Network           | Every host the collector’s code names must be in its manifest’s `hosts` list                                                                                                                                                                        | An undeclared host fails                    |
| Read only         | A behavioural test, in the collector’s own suite, drives it over a recording transport and checks that it never writes (no POST, PUT, PATCH or DELETE), except the read operations its manifest documents, such as a token request or a search POST | Missing or failing fails                    |

The same secrets scan and pre-commit hooks run in every Atlantic repository: see [Supply chain](/security/supply-chain/).

## The release gate

A collector with **any high or critical finding** is marked `release_blocked`, and the release job refuses to tag a release of the repository while any collector is blocked. So no catalogue release, and no page on this site, carries a collector with an open high or critical finding.

## The security summary

The scans are merged into the collector’s `security.json`. The one committed with the collector, and published in the catalogue, is from the last pipeline on the default branch; a merge request’s own result stays with that merge request.

| On the page                | From `security.json`                                                          |
| -------------------------- | ----------------------------------------------------------------------------- |
| Last scanned               | `scanned_on` (the pipeline is in a members-only project, so it is not linked) |
| Findings by severity       | `findings`: critical, high, medium, low and info, across every scanner        |
| Release blocked            | `release_blocked`                                                             |
| Network allow-list check   | `hosts_check`, against the manifest’s `hosts`                                 |
| Read-only behavioural test | `read_only_test`                                                              |
| SBOM                       | `sbom`: the CycloneDX file                                                    |
| Dependency licences        | `licences`: each package and its licence                                      |
| Scanners                   | `tools`: each scanner and its version                                         |

A collector that has not yet been through a scan on the default branch shows Scan pending on each line it lacks and does not show a pass.

Source: https://docs.atlanticagenticlabs.com/collectors/security/