Home
Introduction to HCL® AppScan® Source
HCL® AppScan® Source delivers maximum value to every user in your organization who plays a role in software security. Whether a security analyst, quality assurance professional, developer, or executive, the AppScan Source products deliver the functionality, flexibility, and power you need - right to your desktop.
Important concepts
Before you begin to use or administer AppScan® Source, you should become familiar with fundamental AppScan Source concepts. This section defines basic AppScan Source terminology and concepts. Subsequent chapters repeat these definitions to help you understand their context in AppScan Source for Analysis.

Welcome
Welcome to the documentation for HCL® AppScan® Source.
Introduction to HCL® AppScan® Source
HCL® AppScan® Source delivers maximum value to every user in your organization who plays a role in software security. Whether a security analyst, quality assurance professional, developer, or executive, the AppScan Source products deliver the functionality, flexibility, and power you need - right to your desktop.
- HCL® AppScan® Source Version 10.2.0 Readme and Release Notes®
- Migrating to the current version of AppScan® Source
  This topic contains migration information for changes that have gone into this version of AppScan® Source. If you are upgrading from an older version of AppScan Source, be sure to note the changes for the version of AppScan Source that you are upgrading and all versions leading up to this current version.
- Important concepts
  Before you begin to use or administer AppScan® Source, you should become familiar with fundamental AppScan Source concepts. This section defines basic AppScan Source terminology and concepts. Subsequent chapters repeat these definitions to help you understand their context in AppScan Source for Analysis.
  - Classifications
    Findings are classified by AppScan® Source to indicate whether they are security or scan coverage findings. Security findings represent actual or likely security vulnerabilities - whereas scan coverage findings represent areas where configuration could be improved to provide better scan coverage.
  - Workflow
    AppScan® Source allows for flexibility in how you scan code and remediate issues.
- AppScan® Source deployment models
  This section describes three different deployment models and the components that comprise each model.
- Introduction to HCL® AppScan® Source for Analysis
  This section describes how AppScan® Source for Analysis fits into the total AppScan Source solution and provides a basis for understanding the software assurance workflow.
- Logging in to AppScan® Enterprise Server from AppScan® Source products
  Most AppScan® Source products and components require a connection to an AppScan Enterprise Server. The server provides centralized user management capabilities and a mechanism for sharing assessments. All user management occurs in AppScan Enterprise.
- United States government regulation compliance
  Compliance with United States government security and information technology regulations help to remove sales impediments and roadblocks. It also provides a proof point to prospects worldwide that HCL® is working to make their products the most secure in the industry. This topic lists the standards and guidelines that AppScan® Source supports.
- AppScan® Source and accessibility
  Accessibility affects users with physical disabilities, such as restricted mobility or limited vision. Accessibility issues can impede the ability to use software products successfully. This topic outlines known AppScan® Source accessibility issues and their workarounds.
- Notices
- Copyright
What's New in AppScan® Source
Explore these new features that have been added to AppScan® Source - and note any features and capabilities that have been deprecated in this release.
Installing
Learn how to install the product.
Configuring
Learn how to configure the product.
Administering
Learn how to administer the product.
Developing
Learn how to develop by using the product.
Extending product function
Learn how to extend the product.
Reference
Review reference information for the product.
Troubleshooting and support
There are a number of self-help information resources and tools to help you troubleshoot problems.

Important concepts

Before you begin to use or administer AppScan® Source, you should become familiar with fundamental AppScan® Source concepts. This section defines basic AppScan® Source terminology and concepts. Subsequent chapters repeat these definitions to help you understand their context in AppScan® Source for Analysis.

AppScan® Source for Analysis scans source code for vulnerabilities and produces findings. Findings are the vulnerabilities identified during a scan, and the result of a scan is an assessment. A bundle is a named collection of individual findings and is stored with an application.

Applications, their attributes, and projects are created and organized in AppScan® Source for Analysis:

Applications: An application contains one or more projects and their related attributes.
Projects: A project consists of a set of files (including source code) and their related information (such as configuration data). A project is always part of an application.
Attributes: An attribute is a characteristic of an application that helps organize the scan results into meaningful groupings, such as by department or project leader. You define attributes in AppScan® Source for Analysis.

The principal activity of AppScan® Source for Analysis is to scan source code and analyze vulnerabilities. Assessments provide an analysis of source code for vulnerabilities including:

Severity: High, medium, or low, indicating the level of risk
Vulnerability Type: Vulnerability category, such as SQL Injection or Buffer Overflow
File: Code file in which the finding exists
API/Source: The vulnerable call, showing the API and the arguments passed to it
Method: Function or method from which the vulnerable call is made
Location: Line and column number in the code file that contains the vulnerable API
Classification: Security finding or scan coverage finding. For more information, see Classifications.