> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# TeamCity Setup for Local Code Scanning

> Quickly integrate local scanning with CybeDefend in a TeamCity pipeline using our Docker image.

Use **Docker** to run CybeDefend local scans in your TeamCity pipeline, keeping your code in-house while uploading only the needed data for security analysis.

## Prerequisites

* **Personal Access Token (PAT)**: [Create one](/latest/code-scanning/local-code-scanning/introduction-api-key) in your CybeDefend profile and store it as `CYBEDEFEND_PAT` in TeamCity parameters.
* **Agent Permissions**: Ensure your self-hosted agent can install or run the CybeDefend CLI.
* **TeamCity Access**: Sufficient rights to modify your pipeline definition.

***

## Best Practices

* **Scan the main branch only**\
  By default, all scan results unify under a single “main” or “master” branch in CybeDefend. Limiting scans to your default branch prevents mixing partial results from feature branches.
* **Use Docker**\
  This container-based approach simplifies environment setup, avoiding any installation overhead.

***

## Example TeamCity Configuration (YAML)

If you’re using a YAML-based approach or the TeamCity DSL, a **script** build step might look like:

```yaml theme={null}
jobs:
  local_security_scan:
    steps:
      - type: script
        name: CybeDefend Local Scan
        docker-image: cybedefend/local-scanner:latest
        script-content: >-
          cybedefend scan ./ --ci 
            --project-id %CYBEDEFEND_PROJECT_ID%
```

### Explanation

* **docker-image**: Points to a Docker image (e.g., cybedefend/local-scanner) that already has the CybeDefend CLI installed.
* **script-content**: Runs `cybedefend scan`, zipping your current directory (`./`) and securely uploading it to CybeDefend.
* **--ci**: Outputs minimal logs for a cleaner CI experience.
* **Environment Variables**: `%CYBEDEFEND_PAT%` and `%CYBEDEFEND_PROJECT_ID%` are typically stored in **TeamCity** → **Project Settings** → **Parameters**, masking sensitive data.

<Note>
  If this is your first time scanning the repo, CybeDefend will automatically create a new project (assuming the <strong>Project ID</strong> is valid or left empty to be generated). Subsequent scans append results to the same project.
</Note>

***

## Verifying Results

1. **Console Output**\
   After the step finishes, TeamCity logs display a summary of any critical or high-severity issues.
2. **Further Exploration**\
   Add a subsequent step to fetch results in JSON, HTML, or SARIF formats:
   ```bash theme={null}
   cybedefend results --project-id %CYBEDEFEND_PROJECT_ID% --output sarif --all
   ```
3. **CybeDefend Dashboard**\
   Visit your CybeDefend account to see the complete vulnerability list, including severity breakdowns and recommended fixes.

<Warning>
  For large codebases, scanning can take a few minutes. Make sure your TeamCity job does not have overly strict timeouts.
</Warning>

<Tip>
  You can restrict scanning to <strong>main</strong> by adjusting your TeamCity triggers. This avoids mixing partial or experimental features in your final security reports.
</Tip>