The following plugin provides functionality available through Pipeline-compatible steps. Read more about how to integrate steps into your Pipeline in the Steps section of the Pipeline Syntax page.

For a list of other such plugins, see the Pipeline Steps Reference page.

Sec1 Security Scanner

View this plugin on the Plugins site

sec1MobileScan: Execute Sec1 Mobile Security Scan

Scans a mobile app binary with Sec1 Mobile Security. The binary is uploaded from the workspace, or, with an Artifactory URL, fetched by the scanner node straight from JFrog Artifactory. The step waits for the scan to finish (typically 5–20 minutes), prints a link to the results in the Sec1 console, archives the findings and applies the quality gate. If the build is aborted, the scan is cancelled.
  • apiCredentialsId : String
    ID of a Secret text credential holding your Sec1 API key (the account needs the Mobile Security plan). Defaults to SEC1_API_KEY.
  • binaryPath : String
    Path to the app binary to scan, relative to the workspace: .apk, .aab, .ipa (also .xapk/split bundles). Wildcards are allowed but must match exactly one file, e.g. app/build/outputs/apk/release/*.apk.

    Required unless Artifactory URL is set. When both are set, the binary is not uploaded; its SHA-256 is sent as the Artifact SHA-256 so the scan is tied to the exact file this build produced.

  • actionOnThresholdBreached : String (optional)
  • appName : String (optional)
    Application name shown in the Sec1 console. Defaults to the file name of the binary or of the Artifactory URL.
  • appVersion : String (optional)
    Version recorded with the scan. Defaults to the build number. Environment variables are expanded, e.g. ${BUILD_NUMBER}.
  • applyThreshold : boolean (optional)
  • archiveFindings : boolean (optional)
    Save the scan findings as sec1-mobile-findings.json and archive it with the build, so builds can be compared and the gate audited.
  • archiveReport : boolean (optional)
    After a completed scan, download the executive PDF report and archive it with the build as sec1-mobile-report.pdf, so it can be opened from the build page. Off by default. The report is generated on request, which can take a few minutes. If it cannot be downloaded, the build log shows a warning and the build result is not affected.

    The report is requested from the Base URL first. If the scanner nodes do not serve it, it is fetched from the Sec1 control plane, so the agent then needs to reach Sec1.

  • artifactSha256 : String (optional)
    Optional SHA-256 (64 hex characters) of the binary at Artifactory URL. Artifactory's checksum must match it or the submission is refused. Leave blank to have it computed from Binary Path when that is also set; with neither, the node still verifies the download against Artifactory's own checksum.
  • artifactUrl : String (optional)
    Download URL of the binary your publish step put in JFrog Artifactory, e.g. https://artifactory.example.com/artifactory/mobile-releases/my-app/42/app-release.apk. Environment variables are expanded, e.g. ${ARTIFACT_URL}.

    When set, the binary is not uploaded: the scanner node downloads it from Artifactory with the credential configured on the node, so Jenkins needs no Artifactory credential for this step. The URL must be under the Artifactory base and repository configured on the node, end in .apk, .aab, .xapk or .ipa, and contain no credentials.

  • baseUrl : String (optional)
    Sec1 Mobile Security API that receives the binary.
    • Hybrid (scanner nodes in your network): your load balancer, e.g. https://scanner.example.com/ai-sast-mobile. The binary goes to a scanner node inside your network, never to the Sec1 control plane.
    • Sec1 SaaS: leave empty.
    When empty, the SEC1_MOBILE_BASE_URL environment variable is used, e.g. set once under Manage Jenkins → System → Global properties. It is separate from SEC1_INSTANCE_URL, which only applies to the SCA/SAST steps. The build log shows which value was used.
  • engagementId : String (optional)
    Optional engagement to group this scan under.
  • environment : String (optional)
    Free-text environment label recorded with the scan, e.g. uat or prod.
  • minScore : int (optional)
    Breach the threshold if the scan's aggregate score is below this value (0–100). Leave empty to ignore the score. Setting it applies the threshold action even when no per-severity threshold is configured.
  • pollIntervalSeconds : int (optional)
    How often to check scan progress. Default 20 seconds, minimum 10.
  • resubmitPartial : boolean (optional)
    When a scan ends partial because it was interrupted (for example the scanner node restarted or lost contact), submit it once more. Never done when the reason is a timeout such as stale_scan_timeout: a new scan would stop at the same limit. Uncheck to never resubmit. Default on.
  • scanType : String (optional)
    Scan type recorded on the scan in the Sec1 console. OWASP is the recommended CI default. It is a label: the same analysis runs for every type.
  • source : String (optional)
    Provenance label recorded with the scan. Defaults to jenkins:JOB_NAME#BUILD_NUMBER; keep the jenkins: prefix.
  • threshold (optional)
    Vulnerability threshold for each severity, the same as the Sec1 Security scan step. When this block is not enabled, findings never affect the build result.

    A severity breaches when its count is non-zero and greater than or equal to the configured value: 0 fails on the first finding of that severity, 10 fails when 10 or more are found. Leave a field empty to not check that severity. On a breach the build is marked as selected (Fail, Unstable or Continue).

      Nested Object
    • criticalThreshold : String (optional)
    • highThreshold : String (optional)
    • mediumThreshold : String (optional)
    • lowThreshold : String (optional)
    • statusAction : String (optional)
  • timeoutMinutes : int (optional)
    Maximum time the step waits for the scan, in total: an automatic resubmission counts against the same budget. Default 45 minutes. When it runs out the build fails, and the scan keeps running and stays visible in the console.

    If the stage is wrapped in a Pipeline timeout(...), give that a few minutes more than this value, so this step reports the timeout first.

sec1Security: Execute Sec1 Security Scan

  • apiCredentialsId : String

    This needs to be the ID of an existing "Sec1 API Key" credential. The key will be used to access Sec1 api.

  • actionOnThresholdBreached : String (optional)
  • applyThreshold : boolean (optional)
  • archiveReport : boolean (optional)
    Download the PDF report of each scan that ran and archive it with the build: sec1-sca-report.pdf (SCA Security Assessment) and sec1-sast-report.pdf (SAST, comprehensive). Off by default.

    Reports are generated on request, so this adds a few seconds per scan. If a download fails, the build log shows a warning and the build result is not affected. Not used with asyncScan (fire-and-forget), since the step does not wait for the scan to finish.

  • asyncScan : boolean (optional)
    Submit the scan and exit the build step without waiting for the result. The pipeline keeps running while the scan completes on the Sec1 server. View results on the Sec1 dashboard.

    If Apply Threshold is also enabled, the plugin still polls for the result because threshold checks need the final vulnerability counts. Disable Apply Threshold to get true fire-and-forget behavior.
  • cliInstallation : String (optional)
    The Sec1 CLI installation used when Scan Mode is CLI — one installation serves both scans. Configure it once under Manage Jenkins > Tools > Sec1 CLI with the "Install from sec1.io" installer; it is auto-downloaded to each agent (refreshed daily) and carries both binaries:
    • sec1-cli — resolves the project's dependencies on the agent (using the agent's own build tools and registry credentials), generates an SBOM for the SCA scan and uploads it.
    • sec1-sast — the SAST engine that analyzes the workspace locally and uploads only the findings report.
    The scan log prints the version of each binary used.
  • runSast : boolean (optional)
  • runSca : boolean (optional)
  • sastIncrementalScan : boolean (optional)
    Run the SAST scan in incremental mode. Only changed code is analyzed, which is faster on large repositories. Requires a baseline full scan to exist on the Sec1 server.
  • sastInstallation : String (optional)
  • sastMode : String (optional)
  • sbomFile : String (optional)
  • scaInstallation : String (optional)
  • scaMode : String (optional)
  • scanMode : String (optional)
    Where scans run. One setting for both SCA and SAST.
    • API (default) - the Sec1 server clones the repository and runs the scans on its side. Requires the server to reach your SCM and any artifact registries.
    • CLI - everything runs on the Jenkins agent via the selected Sec1 CLI Installation, so nothing needs to leave your network: SAST analyzes the workspace locally and uploads only the report; SCA generates an SBOM on the agent (with your own toolchain and registry credentials) and uploads it. Works behind private SCMs and private artifact registries (Nexus, Artifactory, private npm).
    The scan log always prints the engine/CLI version used, so it is clear which build produced the findings. (Pipelines that already generate an SBOM can pass it via the sbomFile parameter instead of CLI generation.)
  • scanTag : String (optional)
  • scmUrl : String (optional)
  • threshold (optional)
    Define your vulnerability threshold levels.
    A severity breaches when its count is non-zero and greater than or equal to the configured value: if you set the critical threshold to 10, the build is marked as configured (fail by default) when 10 or more critical vulnerabilities are found; 0 means the first critical vulnerability breaches. Leave a field empty to not check that severity.
      Nested Object
    • criticalThreshold : String (optional)
    • highThreshold : String (optional)
    • mediumThreshold : String (optional)
    • lowThreshold : String (optional)
    • statusAction : String (optional)

Was this page helpful?

Please submit your feedback about this page through this quick form.

Alternatively, if you don't wish to complete the quick form, you can simply indicate if you found this page helpful?

    


See existing feedback here.