> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/get-started/add-pre-commit-hooks.md).

# Add Prisma Cloud Code Security Scanner as a Pre-Commit Hook

Install Prisma Cloud Application Security scanner (Prisma Cloud scanner) as a pre-commit hook into your workflows to automate the scanning of your code for Infrastructure-as-Code (IaC) misconfigurations, Software Composition Analysis (SCA) issues and Secrets vulnerabilities before a commit is created locally. Pre-commit hooks are local hooks that are triggered on the local machine before a commit is created or on other supported Git actions, such as file staging. These hooks enable you to enforce checks or actions before accepting any changes into the VCS.

## Install Prisma Cloud Scanner as a Pre-Commit Hook on a Local Machine

### Prerequisites

Before starting, ensure the following dependencies are installed:

* [Python](https://www.python.org/downloads/) v3.9 - v3.13
* (If using Docker image method) [Docker](https://docs.docker.com/get-docker/)
* [pre-commit](https://pre-commit.com/#install)
* [Checkov](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/connect-code-and-build-providers/ci-cd-runs/add-checkov.md)

Ensure the Prisma Cloud user has one of the following roles or equivalent permissions:

* **Developer**, **Systems Admin**, or **AppSec Admin** role
* Alternatively, for **GRBAC**, provide the following permissions in a [Permission Group](https://docs.prismacloud.io/en/enterprise-edition/content-collections/administration/create-custom-permission-groups).
  * *Policies*: **Policies** - 'View' permissions
  * *Application Security*: **Projects** - 'View' permissions
  * *Settings*: **Providers** - ('View' and 'Create') OR ('View' and 'Update') permissions

For information about roles and permissions on Prisma Cloud, refer to [Prisma Cloud Administrator Permissions](/content-collections/administration/prisma-cloud-admin-permissions.md).

### Installation

1. Set your Prisma Cloud credentials as environment variables. NOTE: This is the recommended security practice. Do not hardcode credentials in your pre-commit hook due to security risks.

**Mac/Linux**

```shell
export BC_API_KEY=<Your Prisma Cloud Access Key>::<Your Prisma Cloud Secret Key>
export PRISMA_API_URL=<Your Prisma Cloud API URL> # Example: https://api3.prismacloud.io
```

**Windows**

```shell
set BC_API_KEY=<Your Prisma Cloud Access Key>::<Your Prisma Cloud Secret Key>
set PRISMA_API_URL=<Your Prisma Cloud API URL> # Example: https://api3.prismacloud.io
```

1. Create a file named `.pre-commit-config.yaml` in the root directory of your repository.

To configure Prisma Cloud code scanning as a pre-commit hook, you have several options. This section details the most basic configuration, which scans the entire repository whenever a Terraform file is modified. For alternative configurations, see [Alternative configuration options](#alternative-configs) below. Recommended: To avoid redundant results uploads, append the --skip-results-upload flag to your pre-commit hook configuration.

```yaml
repos:
  - repo: https://github.com/bridgecrewio/checkov.git
    rev: '3.2.390' # It is recommended to change to tag or sha, such as 3.2.390
    hooks:
      - id: checkov # Alternatively, use checkov_container for an image based scan
        args: [--skip-results-upload, --repo-id, organization/repository, --use-enforcement-rules]
```

1. Optional: add additional configuration settings to the args section of your .pre-commit-config.yaml file, such as --framework and --skip-check . For a complete list of configuration options, refer to the [Checkov CLI Command Reference](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html).
2. Install the hook: Run:

```shell
pre-commit install --install-hooks
```

1. Test pre-commit functionality: Modify a file that is tracked by Git, and execute the git commit command. . Confirm that the pre-commit hook is triggered and that it either allows the commit or blocks it based on the results of its checks.

## Alternative configuration options

Pre-commit hooks offer multiple configuration options. Some examples are provided below.

### Secrets scanning only

Prevent secrets from being exposed in pull requests by identifying and blocking them before they are committed.

```yaml
repos:
  - repo: https://github.com/bridgecrewio/checkov.git
    rev: '3.2.390'  # update the tag or use a sha
    hooks:
      - id: checkov_secrets  # Alternatively, use checkov_secrets_container
        args: [--skip-results-upload, --repo-id, organization/repository, --use-enforcement-rules, -f]
```

### Scan modified files only

This configuration scans only modified files. Cross-file checks should be disabled due to potential limitations.

```yaml
repos:
  - repo: https://github.com/bridgecrewio/checkov.git
    rev: '3.2.390'  # update the tag or use a sha
    hooks:
      - id: checkov_diff  # Alternatively, use checkov_diff_container
        args: [--skip-results-upload, --repo-id, organization/repository, --use-enforcement-rules, --skip-check, "CKV2*", -f]
```

### Complete override

You can fully override the entrypoint to customize configuration options.

```yaml
repos:
  - repo: https://github.com/bridgecrewio/checkov.git
    rev: '3.2.390'  # update the tag or use a sha
    hooks:
      - id: checkov_diff
        entry: checkov --framework cloudformation --skip-results-upload --repo-id organization/repository --use-enforcement-rules -d .
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/application-security/get-started/add-pre-commit-hooks.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.