Getting Started
Prerequisites
- A CSGA tenant and active user account.
- Access to the repository or local project folder you intend to scan.
- Network access to the CSGA API endpoint provided to your tenant.
Recommended onboarding flow
- Confirm access: sign in and verify your tenant context.
- Set context: populate the Assets tab (owner, exposure, route patterns) for key services.
- Baseline scan: run a first scan on a representative repo or load demo data.
- Review results: validate findings with engineering owners.
- Set policy: use the Policy tab to set rule packs, promotions, and threat-intel sync.
- Operationalize: establish a scanning cadence and remediation SLAs.
- Community signals: use feedback and proposal voting to improve shared rule quality.
Quickstart (10 minutes)
- Authenticate in the desktop app.
- Click Load demo to preview a full verdict without scanning.
- Run your first local scan on a small, representative repo.
- Review the report, provide feedback, and export results.
Roles and responsibilities
- Admin: tenant settings, policy bundles, approvals, and user access.
- Reviewer: validates findings, approves fixes, and manages exceptions.
- Contributor: runs scans and performs first-pass triage.
- Voting participant: reviews and votes on rule proposals when enabled.
First scan (desktop)
- Sign in to the desktop app.
- Select a project folder.
- Start a scan and monitor progress.
- Review findings and export a report.
Guided first scan tips
- Pick a repo with known web/API endpoints to see strong signal.
- Reuse the same project name to track lifecycle changes.
- Use the report filters to focus on critical/high findings first.
Next steps
- Integrate the CLI into pull-request pipelines.
- Define escalation paths for critical issues.
- Establish a recurring review of false positives and policy tuning.
- Configure threat-intel sync and review proposals in the Policy tab.