# Scans and the gate
Source: https://docs.infraista.com/en/developer-tools/code-security/scans-and-the-gate



A **scan** checks one commit of a repository with the scanners you turned on. Its **gate** decides
whether the `infraista/security` check passes.

## When scans run [#when-scans-run]

* **Push** to the default branch, or to a branch matching the repository's extra patterns.
* **Pull request** opened, updated or reopened, when pull requests are on.
* **Nightly**, on the default branch, at the time you chose.
* **Scan now** or **Re-run scan** from the console, the
  [Pipelines step](/en/developer-tools/code-security/api-webhooks-and-ci#in-infraista-pipelines), or
  the [API](/en/developer-tools/code-security/api-webhooks-and-ci#the-api).

A scan already queued or running for the same commit is reused instead of starting another.

## New, existing and fixed [#new-existing-and-fixed]

Each scan compares its findings with a base:

* on a branch, the previous finished scan of that branch;
* on a pull request, the newest scan of the branch it targets.

A finding is **new** when the base didn't have it, **existing** when it did, and **fixed** when the base
had it and this commit doesn't. A branch's first scan counts everything as existing. A finding stays
open while any branch or pull request still has it, and reopens if it comes back.

## The gate [#the-gate]

The gate fails on what the change **adds**, so old findings never block a new change. By default:

| Where                                      | Fails on                                                   |
| ------------------------------------------ | ---------------------------------------------------------- |
| Default branch, pull requests, `release/*` | New Critical or High findings, any secret, denied licenses |
| All other branches                         | New Critical findings, any secret                          |

* Secrets fail the gate wherever the policy's **Secrets** box is ticked, even when someone ignored the
  finding, until the secret is removed from the code.
* Ignored findings don't count, except secrets.
* AI code review findings never count.

Change these rules in [Policies](/en/developer-tools/code-security/policies). A repository's own
settings can only make the gate stricter.

The scan page shows the gate result and the reasons, such as "2 new High, 1 secret", with links to the
findings that block.

<Shot name="developer-tools/code-security/scans" alt="A repository's Scans tab listing scans with their trigger, branch or pull request, gate result and new findings" />

## Grades [#grades]

Each repository gets a grade from its open findings on the default branch (ignored findings don't
count). The organization grade is its lowest repository grade.

| Grade | Meaning                               |
| ----- | ------------------------------------- |
| **A** | No open Critical or High              |
| **B** | No Critical, 1–2 High                 |
| **C** | 1 Critical, or 3–5 High               |
| **D** | 2 or more Critical, or 6 or more High |
| **F** | An exposed secret                     |

<Shot name="developer-tools/code-security/repository" alt="A repository's overview with its grade, gate status, findings by scanner and the latest scans" />

## Repository settings [#repository-settings]

On a repository's **Settings** tab you can change:

* **Branches & triggers**: extra branches or patterns, pull requests, and the nightly scan time.
* **Scanners**: at least one scanner (or AI review) must be on.
* **Paths to ignore**: glob patterns such as `docs/**` or `test/fixtures/*.json`, for all scanners or
  one. Ignored paths aren't scanned, so they never create findings.
* **Gate** additions, the **Status check** name, and **Alerts**.
* **Pause scanning**: skips all scans until you resume. The check then reports "Skipped", so a
  required check won't block merges. Findings and settings are kept.
* **Disconnect repository**: stops scanning it and deletes its findings, scans, logs and history now,
  including ignores. The repository itself isn't changed.

Changes apply from the next scan.

<Shot name="developer-tools/code-security/repo-settings" alt="A repository's Settings tab with branches and triggers, scanners, paths to ignore and gate settings" />

## Related [#related]

* [Work with findings](/en/developer-tools/code-security/work-with-findings)
* [Policies](/en/developer-tools/code-security/policies)