Environment variables

Copy .env.example to .env for local development. Docker Compose deployments use additional variables documented in README.md.

Core services

Variable	Required	Description
`DATABASE_URL`	Yes	PostgreSQL connection string
`REDIS_URL`	Yes	Redis for BullMQ job queue
`MINIO_ENDPOINT`	Yes	S3-compatible storage host
`MINIO_PORT`	Yes	MinIO port (e.g. 9000)
`MINIO_ACCESS_KEY`	Yes	MinIO access key
`MINIO_SECRET_KEY`	Yes	MinIO secret key
`MINIO_USE_SSL`	No	`true` / `false`
`MINIO_BUCKET`	Yes	Bucket for scan artifacts

Authentication

Variable	Description
`NEXTAUTH_SECRET`	Session signing / encryption secret (long random string)
`NEXTAUTH_URL`	Public app URL (e.g. `http://localhost:3000`)
`ADMIN_EMAIL`	Seed script default admin email
`ADMIN_PASSWORD`	Seed script default admin password — change after first login
`NEXT_PUBLIC_SOURCE_CODE_URL`	Optional link on login page

GitHub

Variable	Description
`GITHUB_ID` / `GITHUB_SECRET`	Optional NextAuth GitHub login
`GITHUB_OAUTH_CLIENT_ID`	OAuth app for Repositories + fix PR (falls back to `GITHUB_ID`)
`GITHUB_OAUTH_CLIENT_SECRET`	OAuth secret (falls back to `GITHUB_SECRET`)
`TOKEN_ENCRYPTION_KEY`	Encrypts stored GitHub tokens (defaults to `NEXTAUTH_SECRET`)
`GITHUB_WEBHOOK_SECRET`	HMAC secret for `/api/webhooks/github`
`GITHUB_WEBHOOK_MAIN_SCAN_TYPE`	Default-branch push scan: `SAST_ONLY` or `FULL`
`GITHUB_PR_TOKEN` / `GITHUB_TOKEN`	Legacy PAT — not used when OAuth is connected

Authorization callback URL:
{NEXTAUTH_URL}/api/integrations/github/callback

OAuth scopes requested: read:user repo

Bitbucket Cloud

App password and workspace are configured in Settings → Integrations (encrypted in DB). Webhook secret optional in UI or env.

Variable	Description
`BITBUCKET_WEBHOOK_SECRET`	HMAC secret for `/api/webhooks/bitbucket` (`X-Hub-Signature`)

Webhook triggers: repository push, pull request created, pull request updated → PR events queue INCREMENTAL scans.

Azure DevOps

Organization name and PAT are configured in Settings → Integrations. Service hooks use Basic auth (password only).

Variable	Description
`AZURE_DEVOPS_WEBHOOK_SECRET`	Basic auth password for `/api/webhooks/azure-devops`

Service hook events: git.push, git.pullrequest.created, git.pullrequest.updated.

Default-branch webhook scans

Variable	Default	Description
`GITHUB_WEBHOOK_MAIN_SCAN_TYPE`	`SAST_ONLY`	Scan type after push/merge to default branch (GitHub, Bitbucket, Azure)

GitLab

Variable	Description
`GITLAB_ID` / `GITLAB_SECRET`	Optional GitLab OAuth
`GITLAB_URL`	GitLab instance base (default `https://gitlab.com`)

LLM & worker

Variable	Default	Description
`OPENROUTER_API_KEY`	—	Cloud LLM via OpenRouter
`OPENROUTER_MODEL`	—	Default model when using OpenRouter env key
`WORKER_CONCURRENCY`	2	Parallel scan jobs per worker
`MAX_LLM_CONCURRENCY`	5	Parallel LLM calls within a scan
`LLM_CHUNK_TOKENS`	3000	Code chunk size for API models
`LLM_CHUNK_OVERLAP_TOKENS`	200	Overlap between chunks
`LLM_MAX_RESPONSE_TOKENS`	4096	Max LLM response tokens
`OLLAMA_CHUNK_TOKENS`	1200	Chunk size for local Ollama
`OLLAMA_CHUNK_OVERLAP_TOKENS`	100	Ollama overlap
`OLLAMA_MAX_RESPONSE_TOKENS`	2048	Ollama max response
`LLM_MIN_CONFIDENCE`	0.7	Drop LLM findings below this confidence
`OLLAMA_HOST`	—	Docker: host Ollama URL (see README)

Supply chain & SCA

See Supply chain security for what these control. Every external lookup degrades gracefully: if a source is unreachable the scan continues and reports less, rather than reporting a clean result it cannot support.

License policy

Variable	Default	Description
`LICENSE_POLICY_DENY`	`AGPL-,GPL-,SSPL-,BUSL-,CC-BY-NC-*,Commons-Clause,Elastic-2.0`	Licenses that fail policy (HIGH finding). SPDX IDs or `PREFIX-*` wildcards, comma-separated
`LICENSE_POLICY_WARN`	`LGPL-,MPL-,EPL-,CDDL-,OSL-,MS-RL,CPAL-`	Licenses allowed but flagged for review (LOW finding)
`LICENSE_POLICY_FLAG_UNKNOWN`	`false`	Report dependencies whose license could not be determined

Dependency metadata (deps.dev)

Variable	Default	Description
`ENABLE_DEPS_DEV`	`true`	Set `false` to disable license, provenance, and dependency-path lookups entirely (air-gapped)
`DEPS_DEV_API_URL`	`https://api.deps.dev`	Override to point at a mirror
`DEPS_DEV_TIMEOUT_MS`	10000	Per-request timeout
`DEPS_DEV_CONCURRENCY`	10	Parallel metadata requests
`DEPS_DEV_CACHE_TTL_MS`	21600000	Metadata cache lifetime (6h). Package metadata is immutable per version, so repeat scans are nearly free
`DEPS_DEV_MAX_CACHE_ENTRIES`	20000	Cache size bound
`DEPS_DEV_MAX_GRAPH_FETCHES`	60	Max dependency graphs fetched per scan when explaining transitive vulnerabilities. Truncation is reported in the scan log

Exploitation signals

Variable	Default	Description
`ENABLE_EPSS_KEV`	`true`	Set `false` to disable EPSS and CISA KEV enrichment
`EPSS_API_TIMEOUT`	10000	EPSS request timeout

AI triage of dependency CVEs

Triage reads the published advisory text so exploitability conditions come from the advisory rather than the model's recollection. These budgets keep the advisory inside the model's context window — local models default to a much smaller window, so they use smaller values.

Variable	Default	Description
`SCA_TRIAGE_ADVISORY_CHARS`	1500	Advisory characters per CVE (API models)
`SCA_TRIAGE_ADVISORY_CHARS_OLLAMA`	500	Advisory characters per CVE (local models)
`SCA_TRIAGE_BATCH_SIZE`	20	CVEs per triage request (API models)
`SCA_TRIAGE_BATCH_SIZE_OLLAMA`	8	CVEs per triage request (local models)
`MALICIOUS_PKG_MIN_CONFIDENCE`	0.8	Minimum confidence for AI malicious-package findings

Raising the advisory or batch values on a local model can silently overflow its context window and degrade triage quality. Increase the model's context size first.

Container image scanning

Variable	Default	Description
`TRIVY_CACHE_DIR`	`/var/cache/trivy`	Trivy database location. Mount a pre-populated cache here for air-gapped scanning

Trivy ships inside the worker image, so no host installation is required. When the vulnerability database mode is offline, Trivy scans against the mounted cache without attempting an update.

Email (SMTP)

Variable	Description
`SMTP_HOST`	Mail server hostname
`SMTP_PORT`	Usually 587 (TLS) or 465
`SMTP_USER` / `SMTP_PASSWORD`	Credentials
`SMTP_FROM`	From address
`SMTP_TLS`	`true` to use STARTTLS

Local dev: use Mailpit or similar on port 1025/8025.

Docker-only (README)

Production Compose may also define:

POSTGRES_PASSWORD, PEPPER_PORT, WORKER_REPLICAS
PEPPER_IMAGE, PEPPER_VERSION for private registries

UI settings (LLM provider, policies, build gates) are stored in PostgreSQL per organization. Environment variables act as defaults and fallbacks for LLM keys and SMTP.