How do I focus a white-box scan on one part of my codebase?

Steps

1. Check the target. Make sure the profile's target has a repository. Black-box targets have none, so a code path means nothing there.
2. Open the profile. Edit it with the pencil icon in Scan Profiles, or start a new one.
3. Add a Focus rule. Scroll to Scope rules on the Scope section and click + Add rule under Focus rules.
4. Choose Code Path. Set Type to Code Path.
5. Enter the location. Type the folder or file in Value, such as src/billing, and add a Description.
6. Save. Click Save.

Good to know

A white-box scan reads your source code while it tests the running app. A Code Path focus rule tells it which part of that code matters most, which suits a pull request that touched one module or a service you just rewrote.

Focus narrows attention but does not remove the rest of the app from the picture. Keep the rule list short so the scan stays useful, and review it when the code layout changes. If you move a folder, update the rule, or it will point at nothing. For a wider overview, read focus rules compared with avoid rules.

Not sure of the right path? Look at the repository in your code host and copy the folder name as it appears there, or ask your developers. For anything else, write to /contact.

Related questions

• How do I add a focus rule so a scan concentrates on certain paths?
• What's the difference between focus rules and avoid rules?
• Which rule types can I use in focus and avoid rules?
• How do I connect a Git repository to a target?
• How do I delete a focus or avoid rule?

Full tutorial

How to set focus and avoid rules on a scan profile

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre