Azure Pipelines

Install the Marketplace task, add ScrutoraScan@1 to your pipeline, and findings render on a build tab via SARIF. Offline, no API key, and your code never leaves the agent.

01 · Setup

3 steps.

01Install the extension

Add the Scrutora Scan extension to your Azure DevOps organization from the Visual Studio Marketplace.

02Add the task

Reference the task in your pipeline YAML with your frameworks and gating severity.

- task: ScrutoraScan@1
  inputs:
    frameworks: dpdpa,hipaa
    failOn: high          # none|low|medium|high|critical

03View findings on a build tab

The task publishes SARIF as the CodeAnalysisLogs artifact. Install Microsoft's free SARIF SAST Scans Tab extension to render findings on a build tab automatically.

02 · What you get

After the first run.

Build gating

failOn fails the build on high/critical findings so non-compliant code can't ship.

SARIF scans tab

Findings render on a build tab via the CodeAnalysisLogs artifact.

Obligation citations

Each finding maps to the exact DPDPA/HIPAA/PCI obligation, not a generic rule id.

Runs on hosted agents

Works on Microsoft-hosted ubuntu agents (Docker included) or any self-hosted agent with Docker.

03 · Questions

The ones people actually ask.

Where do the results appear?

As the CodeAnalysisLogs build artifact (SARIF v2.1.0). With the free SARIF SAST Scans Tab extension they render on a dedicated build tab.

Does it run on self-hosted agents?

Yes, as long as the agent has Docker. Microsoft-hosted ubuntu agents include it by default.

Which frameworks are supported?

DPDPA, HIPAA, GDPR, PCI-DSS, RBI and more, set the frameworks input.

Azure Marketplace

04 · Try itPUBLIC REPOSITORIES

Wire it into a build.

A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.