Scheduled Scans

Cron-driven recurring scans across DAST, SAST, SCA, Secrets, API. One-off runs are a debug tool; schedules are how teams stay protected.

Why schedules

Vulnerabilities don't respect business hours. A new CVE drops, a developer commits a secret, an attacker probes your auth endpoint — all of these need detection within hours, not next week. Schedules turn Sectora from a manual scanner into continuous monitoring.

Creating a schedule

  1. Scans → Schedules → + New schedule
  2. Pick scan type (DAST / SAST / SCA / Secrets / API)
  3. Pick target(s) — single URL, list, or all-of-project
  4. Pick profile + auth + scan-specific options (same as the one-off scan dialog)
  5. Set cron expression — UI offers presets (Daily 02:00, Weekly Monday 06:00, Hourly) or custom cron
  6. Configure alert routing for the schedule (which channels to alert when findings appear)
  7. Save. First run happens at next cron tick.

Recommended patterns

# Daily Quick DAST on every public origin
# - catches regressions from yesterday's deploys
# - 5 min per origin × 10 origins = 50 min, well within nightly window
0 2 * * *  Quick DAST  prod origins

# Weekly Full DAST on staging
# - broader coverage when slow scans don't impact prod
0 4 * * 0  Full DAST   staging origins

# Daily SCA on every connected repo
# - catches new CVE advisories within hours
0 3 * * *  SCA         all-repos

# Daily Secrets on every connected repo
# - catches accidentally-committed keys
0 3 * * *  Secrets     all-repos

# Daily SAST on main branches
# - source-level regression detection
0 5 * * *  SAST        main

# Hourly Quick DAST on critical assets
# - tier-0 services get faster regression detection
0 * * * *  Quick DAST  tier-0 assets

# Weekly SAST on all branches (catches PR-deferred vulns)
0 6 * * 6  SAST        all-branches

Concurrency + throttling

Sectora's scan workers process schedules in parallel up to your plan's concurrent-scan limit (Pro: 5, Business: 20, Enterprise: unlimited). Overlap is automatic — if a Daily scan hasn't finished by next-day, the new run waits rather than queueing infinitely.

Cost controls

  • Pause — temporarily disable a schedule without deleting it. Useful during planned maintenance windows.
  • Conditional skip — "skip the daily SAST if no commits since last run". Saves compute on quiet projects.
  • Skip if no diff vs baseline — DAST/SAST/SCA skip if the target hasn't changed (different commit / different deployed digest).

Failure handling

When a scheduled scan fails (target unreachable, auth broken, repo deleted, etc.):

  • One automatic retry after 5 minutes.
  • If both fail: alert to the schedule's configured channel (default: org admins).
  • Three consecutive failures → schedule auto-paused with a notification. Prevents alert storms when a target is permanently broken.

Visibility

Scans → Schedules shows each schedule's last run + next run + recent finding count. Click into a schedule for full history + per-run diff (what's new since the previous run).

What's next

  • Alerts — wire schedule findings to your channels.
  • PR Gates — pre-merge complement to scheduled scans.