Run Snippet Detection

This guide walks you through running Snippet Detection scans using Frogbot V3 and the JFrog CLI. Snippet Detection identifies the origin of code snippets in your source code, whether generated by AI, copied from the web, or extracted from another repository, and surfaces the security and license risks they carry.

• Run Snippet Detection with Frogbot V3
• Run Snippet Detection with JFrog CLI

Prerequisites

Before using Snippet Detection, confirm that you meet these requirements.

• Entitlement: JFrog Unified Security bundle or higher. Snippet Detection is included as part of the Unified Security entitlement.
• Platform requirements: A JFrog Platform Deployment with access to the JFrog Catalog service. The JFrog Catalog service must be available and reachable from the JFrog Platform.

Use these minimum versions.

Run Snippet Detection with Frogbot V3

Frogbot V3 can automatically scan pull requests for snippet-level risks as part of your source control workflow. Use the centralized platform configuration. It manages scan settings from the JFrog Platform user interface, and you don't change individual repository configuration files.

Configure Snippet Detection in the Platform

To configure Snippet Detection in the platform:

1. In the JFrog Platform, navigate to Administration > Xray Settings > Indexed Resources.
2. Select the Git Repositories tab.
3. Select one or more Git repositories or folders that you want to scan.
4. From the actions menu, select Configure.
   The Scan Configurations window opens.
5. Enable Snippet Detection as a scan type alongside your other scanners. These scanners include Software Composition Analysis (SCA), Contextual Analysis, infrastructure as code (IaC), Secrets, and static application security testing (SAST).
6. Click Apply.

Subfolders and repositories you add later inherit these settings from the JFrog Platform, so you can set them once at a higher level.

For more information, see Git Repository Configuration.

Trigger a Scan

After you configure Snippet Detection, Frogbot V3 includes snippet detection in pull request scans.

To trigger a scan:

1. Open a pull request in any configured repository.

Frogbot will:

• Analyze the source code in the pull request for code snippets matching public open-source repositories.
• Report any license compliance violations or security findings directly on the pull request.
• Provide scan results in the JFrog Platform under Xray > Scans List.

Run Snippet Detection with JFrog CLI

You can run snippet detection scans directly from your terminal or as a step in your CI/CD pipeline using the JFrog CLI.

Configure the JFrog CLI

Add your JFrog Platform server and set it as the active configuration.

To configure the JFrog CLI:

• Run the following commands:

  Bash

  jf c add <SERVER_ID> --url=<JPD_URL> --access-token=<ACCESS_TOKEN>
  jf c use <SERVER_ID>

  Where:

  • <SERVER_ID>: The server ID for your JFrog Platform
  • <JPD_URL>: The URL of your JFrog Platform
  • <ACCESS_TOKEN>: Your access token

  For example:

  Bash

  jf c add my-server --url=https://my-instance.jfrog.io/ --access-token=<ACCESS_TOKEN>
  jf c use my-server

For more information, see JFrog CLI.

Navigate to Your Project Directory

To navigate to your project directory:

• Open a terminal and set your current directory to the project directory you want to scan:

  Bash

  cd <PROJECT_PATH>

  Where:

  • <PROJECT_PATH>: The path to the project directory you want to scan

  For example:

  Bash

  cd /path/to/my-project

Run the Audit Command

To run the audit command:

• Run the jf audit command with the snippet detection flags:

  Bash

  jf audit --sca --sbom --static-sca --snippet --watches=<WATCH_NAME>

  Where:

  • <WATCH_NAME>: The Xray watch to evaluate policy violations against. Use a comma-separated list for multiple watches.

The following table describes the command flags.

Understanding the Results

After the scan completes, the CLI displays:

• License Compliance Violations: Any snippets whose originating open-source project carries a license that violates your policy.
• Software Bill of Materials (SBOM): A list of detected open-source components, including snippet matches.
• Full results: A link to the full results in the JFrog Platform under Xray > Scans List > Repositories.

The JFrog Platform keeps these scan results for 7 days, and then deletes them.

Example

$ jf c use my-server
Using server ID 'my-server' (https://my-instance.jfrog.io/)

$ cd /path/to/my-project

$ jf audit --sca --sbom --static-sca --snippet --watches=license-watch
####### Starting jf audit Scan #######
Command flags: [--sbom=true --sca=true --snippet=true --static-sca=true --watches=license-watch]
####### jf audit Scan Finished #######

License Compliance Violations
┌──────────────────┬──────────┬────────────┬───────────────┬────────────┬────────┬──────────────┐
│ LICENSE          │ SEVERITY │ DIRECT     │ IMPACTED      │ IMPACTED   │ TYPE   │ WATCH NAME   │
│                  │          │ DEPENDENCY │ DEPENDENCY    │ VERSION    │        │              │
├──────────────────┼──────────┼────────────┼───────────────┼────────────┼────────┼──────────────┤
│ GPL-2.0-or-later │ High     │ ffmpeg     │ ffmpeg:ffmpeg │ snippet    │ Github │ license-watch│
└──────────────────┴──────────┴────────────┴───────────────┴────────────┴────────┴──────────────┘

Software Bill of Materials (SBOM)
┌──────────────────────────────┬─────────┬────────┬──────────┐
│ COMPONENT                    │ VERSION │ TYPE   │ RELATION │
├──────────────────────────────┼─────────┼────────┼──────────┤
│ ffmpeg/ffmpeg                │ snippet │ Github │ Root     │
└──────────────────────────────┴─────────┴────────┴──────────┘

Related Topics

• Snippet Detection
• Scanning Commits and Pull Requests
• Scan Your Source Code
• License Compliance