Getting started: workspace, source control and first scan

Signing in and the onboarding wizard

Your workspace is your Plexicus organization: the account that holds your members, connections, repositories and findings. The product and the rest of this course call it the organization.

How you first reach Plexicus depends on how your company runs it. On Plexicus SaaS you sign in at app.plexicus.ai. A self-hosted deployment uses your own hostname. If an admin invited you to an existing organization, accept the invitation email first. Don’t register on your own first: self-registration creates a separate organization. Invitations, roles and SSO setup are covered in module 10.

Registering and signing in

The Register page offers one-click registration with GitHub, Google or Microsoft, plus “or register with email” (Email, Password, Confirm Password). In some regions the page shows only the email form. Tick the Terms checkbox before you register, whether with a provider button or by email. If you don’t, the checkbox is flagged and registration does not go through. Email passwords need at least 8 characters, including an uppercase letter, a lowercase letter, a number and a special character. After you submit, Plexicus shows “Check your email”. Click the verification link, wait for “Your email is verified”, then log in.

The Login page offers the same three providers, “Login via SSO”, where you type your organization’s SSO login slug (ask your admin for it; the field’s placeholder looks like an email address), and email and password with a “Forgot password?” link. If your organization has configured SSO, use it, so your identity provider controls who gets in.

The four stages

In a new organization, your first login opens the onboarding wizard. Its left rail tracks four stages:

Stage	What you do
Connect	Pick a source control provider and authorize it, or choose a demo codebase
Choose repos	Search your repositories, tick up to 5 and pick a branch for each
Basic config	Set an optional organization name, compliance standards and the scan and report language
Scanning	Watch Plexalyzer, the Plexicus scanning engine, analyze your repositories

Connect. “Connect your repository” shows one card per provider: GitHub (badged “Most popular”), GitLab, Bitbucket Cloud, Gitea, Forgejo and Azure DevOps. Click Configure on a card to authorize it or enter credentials; lesson 2 explains each provider. A connected card reads Configured, and Continue becomes active.

The demo codebase option. Below the cards, under “Or try it instantly”, click Try sample repo. “Select a Demo Codebase” lists safe, pre-configured sample repositories that contain intentional vulnerabilities. Tick one or more and click Continue. Take this path when you want to see real findings before your security team approves a connection to production code, or when you are training a colleague.

Choose repos. Search, tick up to 5 repositories and set the branch for any repository that has more than one. For most providers, you can add more repositories later from Assets (lesson 3).

Basic config. Three settings shape the first scan:

• Organization name (optional).
• Compliance standards: pick one or more, such as NIS2, DORA, CRA, GDPR, ISO 27001
  , PCI DSS v4.0.1 or SOC 2, or choose “None for now”. Findings are mapped to each framework so reports show coverage gaps. Plexicus produces mappings and evidence for your audits, not a compliance verdict. Frameworks not included in your plan show as locked.
• Scan & report language: remediation notes, pull request text and reports are written in this language. English and Spanish are available.

Order matters on this step. Plexicus creates the repositories and starts their first scan only when you click Start scan. That is how the very first scan already uses your frameworks and language. Use “Back to repositories” if you need to change the selection first.

Scanning. “Scanning in progress” tracks the analysis. You don’t have to wait on this screen: the “Your scan is running in the background” strip lets you continue to Assets while the scan keeps running on the server. The strip’s button reads Go to dashboard but opens Assets, where you can watch the scan. When every repository reaches Enriched, onboarding completes and Plexicus takes you to the Dashboard.

Connecting source control

Plexicus scans code it reads from your source control (SCM) provider, and it delivers fixes back to the same place as pull requests and issues. The permissions a connection asks for map directly to those two jobs. Your code is not used to train AI models, and SaaS data stays in the EU by default.

After onboarding, manage connections under Settings Configuration Integrations . The “Source Control (SCM)” section shows each provider as Connected or Not connected, with a Connect or Manage button. You can connect several providers, and Plexicus scans repositories across all of them.

Provider reference

Provider	How it connects	What you provide
GitHub.com	OAuth redirect, then the Plexicus GitHub App install	Approve organization access, choose repositories
GitHub Enterprise Server	Instance credentials	GitHub Enterprise URL plus a personal access token, OAuth App client ID and secret, or GitHub App ID and private key (PEM)
GitLab.com	OAuth redirect	Approve the scopes
GitLab Self-Hosted	OAuth application on your GitLab	Gitlab URL, Gitlab Client ID, Gitlab Client Secret
Bitbucket Cloud	OAuth redirect	Approve access; Server and Data Center are not supported
Gitea	Access token	Gitea URL, Token
Forgejo	Access token	Forgejo URL, Token
Azure DevOps	Access token	Personal Access Token (PAT), optional Organization URL

In Settings Configuration Integrations , the GitHub and GitLab cards ask for the instance type first. That is where you connect GitHub Enterprise Server or a self-managed GitLab. Confirm GitHub Enterprise Server support for your instance with Plexicus before you plan a rollout around it.

What access Plexicus needs, and why

Read access covers discovery and scanning; write access covers delivery. Scope names differ by provider:

Access	Why Plexicus asks for it
Read repositories and branches	List repositories, load branches and clone the selected branch for scanning
Read user or account	Verify the token or account and show which profile is connected
Write pull or merge requests	Open remediation pull requests for your review (module 7) and the CI pipeline pull request
Write issues or work items	Create an issue when a fix cannot be delivered as a pull request
Webhooks	Learn when a Plexicus pull request is merged or a linked issue is closed, so the finding becomes Fixed
CI/CD variables and secrets	Store the scanner token as a repository secret when you set up a pipeline

Write access never means Plexicus merges. It opens pull requests; your team reviews them and keeps merge control, and nothing changes in production automatically.

Provider notes

• GitHub.com. After the OAuth redirect, install the Plexicus GitHub App on the account or organization that owns your repositories, select the repositories to share and explicitly approve access to organization resources. If GitHub shows as connected but no repositories appear, use the Install GitHub App button in the repository picker.
• GitLab. Plexicus requests eight scopes: api, read_api, read_user, read_repository, write_repository, openid, profile and email. For a self-managed instance, register an OAuth application on your GitLab, tick Trusted, select those scopes and set the Redirect URI to your Plexicus host followed by /api/callback/gitlab (on SaaS, https://app.plexicus.ai/api/callback/gitlab). Then enter the instance origin, client ID and secret in Plexicus and click Connect.
• Bitbucket Cloud. Only bitbucket.org is supported. If you run Bitbucket Data Center, mirror the repositories to a supported provider.
• Gitea and Forgejo. The token needs repository read and user read, plus repository write for remediation pull requests. Plexicus validates it against your instance before saving, so the instance must be reachable from Plexicus.
• Azure DevOps. Grant the PAT the scopes the connector’s help text names: Code (Read & Write) and Work Items (Read & Write). The public docs also list Pull Request Threads (read & write). Leave Organization URL blank for https://dev.azure.com, or enter your on-premises server URL. The same connection covers TFVC projects, and because TFVC has no pull requests, TFVC fixes always arrive as issues.

Adding and managing repositories under Assets

Assets holds your repositories, container registries and cloud accounts in three tabs: Repo Scan, Registry Audit and Cloud Assessment. AI Pentest targets live under Pentest. This lesson covers Repo Scan.

Adding repositories

Open Assets Repo Scan Add Repository . The same button also sits on the Findings toolbar. What happens next depends on your connections:

• One connected provider: Manage Repositories opens directly.
• Several providers: “Select Source Control” asks which one to add from. With Azure DevOps connected, the list includes “TFVC (Azure DevOps / TFS)”.
• None: a message says you don’t have source control configured yet and redirects you to the connector page.

In Manage Repositories:

1. Search the list. Each repository carries a Private or Public badge, and repositories you already added are marked “Repository already exists”.
2. Tick up to 5 repositories per batch.
3. Pick a Branch for each selected repository that has more than one.
4. Optionally open Advanced Options to choose which security tools run (module 3).
5. Click Launch. Plexicus creates the repositories and queues a scan for each.

Pick the branch you actually ship from. A scan of a stale feature branch can report a vulnerable dependency you already upgraded on main, or miss a SQL injection merged last week.

The Repo Scan table

The columns are Actions, SCM, Repo, Findings (counts per severity), Pipeline, Priority, Tags, Branch, Creation Date and Finished Scan At. Download exports the list as repositories.csv. Each row offers these actions:

Action	What it does
Configure	Choose the security tools for this repository
Re-Scan	Delete and re-create the repository, then scan it again
Show Findings	Open Findings filtered to this repository
Exposure Map	Open the repository’s exposure analysis
Show Repository	Open the repository in your SCM
Configure Schedule	Opens the organization-wide Schedule Scan setting, read-only. It is not a per-repository schedule. Availability depends on your plan
Delete Repository	Remove the repository from Plexicus

For a dependable scan cadence, run scans from your CI pipeline (module 3) instead of relying on a schedule.

While a repository is queued, running or enriching, its status indicator replaces these actions. Select several rows to get the bulk actions Re-Scan, Configure and Delete Repository. Bulk delete is limited to the Admin and Cyberoper roles.

Re-Scan versus Finalize Now

Re-Scan is a clean slate. Its confirmation says so: it deletes and re-creates the repository, clearing all existing findings. To scan a repository again and keep its findings, use Relaunch scan in the Activity Center (next lesson).

A scan that stops making progress shows a “Scan Stuck” badge. Its tooltip shows the last activity and how many tools delivered results. Click the badge to open “Scan Stuck — Action Required” and choose Finalize Now. Plexicus recalculates the finding counts and marks the repository complete, with no data lost. If the scan is in fact still healthy, Plexicus refuses to finalize it and lets it keep running. If nobody acts, Plexicus finalizes a scan that has stalled for several hours on its own.

CI pipeline setup

For supported providers, Setup Pipeline in the Pipeline column becomes clickable once the repository is enriched. It opens a pull request that adds the Plexalyzer workflow to the repository, and nothing changes in your CI until someone on your team merges it. Module 3 covers the supported providers, the pipeline statuses and the Plexalyzer token.

Following a scan

In the Repo Scan table, the Actions column shows queued, running or enriching while a scan is in progress. Enriching means the scanners have finished and AI enrichment is still running. When the repository is enriched, that indicator disappears and the row actions, findings counts and Pipeline button return. Enriched means the scan is done.

The Activity Center

On the Assets page, the activity tray shows how many scans are running and how many completed today. Click Assets Open Activity Center for the full panel. Set the scope to “This view” (the current asset type) or “All assets”, then filter:

• Overview: running scans plus the latest result per asset.
• Running: only scans in progress.
• Issues: stalled or partial runs that need attention.
• History: every run, newest first.

Each run is a card with a phase stepper:

Phase	What is happening
Queued	The request is accepted and waiting for a slot
Preparing environment	The analysis environment is being prepared
Scanning	The security tools are running
Processing results	Results are normalized and ingested as findings
Completed	The scan finished
Enriched	AI analysis and prioritization have been applied

Cards offer View findings, Relaunch scan on finished runs (including partial ones), and Cancel on running ones (you confirm it). Relaunch scan requests a new scan of the same repository and deletes nothing. That makes it the gentle alternative to Re-Scan.

Two card states deserve attention:

• Stalled: no recent progress. Plexicus retries automatically, and the stepper shows the retry attempt.
• Partial: some tools did not finish, and the stepper explains it as Degraded. The findings delivered are real, but the parts that were not covered were not scanned, so they are not known to be clean. Click Relaunch scan on the card to scan again and keep your findings. The product text says “re-scan recommended”, but the Re-Scan row action clears all findings.

Notifications

The header bell lists recent notifications, with Mark all as read and Show All Notifications. The Notifications page has the tabs All, Success, Failures, Review Requests and Flagged, and you can select items to delete them or mark them as read. During a first scan you may see messages such as “Repository created” and “Scan completed”. A “Repository creation failed” message names the repository, and a partial-coverage message tells you which part of the scan did not finish.

Support, in the sidebar footer or the profile menu, opens a Contact support form: enter a Subject, pick a Category and Priority, write a Message and click Send ticket. The team replies by email.

What “enriching” means

Scanner output is raw. Enrichment turns it into findings you can prioritize:

• Validation. Each finding keeps its scanner severity and also gets an AI-validated severity.
• Deduplication. A repeat of an earlier finding at the same location becomes a duplicate. A dependency finding for the same library, version and CVE at the same location becomes a sub-finding of the main one.
• Context. Reachability, EPSS for findings that carry a CVE, a CWE-to-OWASP Top 10 mapping, OWASP CI/CD Top 10 controls and your compliance frameworks.
• Scoring and ownership. A 0–100 priority score, a confidence value, and an issue owner taken from SCM blame of the affected file.

If your organization has turned on AI False-Positive Detection, it also runs an AI pass after the scan. Findings that are still enriching are hidden from the findings list by default, and finished ones are labeled “AI-Analysed”. That is why the list can look short just after a scan reaches Completed. Module 4 explains each field in depth.

A first tour of the Dashboard

When onboarding ends, you land on the Dashboard. The sidebar and the ⌘K command palette work as described in module 1. The palette jumps between sections only; it does not search findings or repositories.

Most of the course lives behind the sidebar entries. Pentest is where AI Swarm Pentest appears as “AI Pentest” (module 6). Findings is where you triage (module 4), XBOM is the component inventory (module 8), the Automations page (Plexicus Automation) is covered in module 9, and Settings in module 10.

Filters and tabs

The filter bar sets the date range (7d, 30d, 90d, All or Custom) and the repository, and the widgets follow it. The active tab is kept in the URL, so a link ending in ?tab=compliance opens the Compliance tab directly.

Tab	Main widgets
CISO	Your value, Risk Posture Score, New vs Fixed, Findings Report, Top Risky Repositories, Total Findings, Supply Chain, Internet exposure
DevSecOps	Reachability Split, Aging Buckets, MTTR / Remediation Velocity, Scanner Coverage, Language Risk, OWASP Top 10, OWASP CI/CD Top 10
Compliance	Per-framework figures (Controls, Open findings, Critical / High, Fixed, Affected assets) and a control-by-control table, depending on your plan
Developer	My repositories, Fix Impact Simulator and “Jump into findings” shortcuts such as Critical & High and Reachable
Custom	Your own named dashboards: Create a dashboard, Add widget, Edit layout

Reading your first numbers

• Totals count only open work. They exclude duplicates, sub-findings, false positives, deleted findings and findings already Fixed, so they can be lower than the raw count a scan reported. Hardening findings are counted separately from vulnerability figures.
• Your value shows benchmark estimates of developer time saved. You can configure the hourly rate and currency, but these are benchmark figures, not measurements of your environment. Present them that way.
• Risk Posture Score runs from 0 to 100, and higher means more risk. It weights open findings by severity, counts findings proven reachable more heavily, and is drawn against a risk-appetite line that is fixed for now and cannot be configured.
• Scanner Coverage shows how recently each repository and tool was scanned. A repository marked “Never scanned” has not completed a scan yet.
• Compliance shows “No compliance frameworks configured” if you chose “None for now” during onboarding. Its Configure frameworks button opens the Regulations tab of your organization settings.

A widget that reads “No data yet” has nothing to show for the current filters. Widen the date range, or check in the Activity Center that the run reached Enriched.

Key takeaways

• Onboarding has four stages: Connect, Choose repos, Basic config and Scanning. The first scan starts only when you click Start scan, so set compliance standards and language before you do. A demo codebase lets you explore without connecting your own code.
• Each SCM permission maps to a job: read access to discover and scan, write access to open pull requests and issues, webhooks to mark merged fixes as Fixed. Plexicus never merges; your team keeps merge control.
• Add repositories in batches of up to 5 from Assets Repo Scan , and scan the branch you actually ship.
• On a stuck scan, use Finalize Now to keep findings. Re-Scan deletes and re-creates the repository and clears all its findings, while Relaunch scan in the Activity Center deletes nothing.
• A scan is done at Enriched, not Completed. Enrichment adds validated severity, deduplication, reachability, EPSS, mappings, priority and ownership. A Partial (Degraded) run delivers real findings but incomplete coverage; fill the gap with Relaunch scan, not Re-Scan.
• Dashboard totals count only open work. Use the tabs and filters to confirm coverage before you start triage.