Getting Started with CAST Highlight
Set up roles, users, domains, surveys and campaigns, then analyze your applications with the Code Reader. The Code Reader scans your application source code locally, extracts software health, cloud maturity, and open-source composition metrics, and packages the results for upload to your CAST Highlight portal — no source code ever leaves your machine.
Technical Requirements
- Microsoft Windows ≥ Windows 10, or Linux / Mac
- Google Chrome recommended
- Microsoft Edge, Firefox ESR supported
- Unsupported vendor versions are not guaranteed
- 600 MB free disk space
- 8 GB memory
- Administrator privileges to run the installer
- Stored as text files, UTF-8 encoding
- Accessible from the machine running the Code Reader
Roles & Access Rights
CAST Highlight provides access rights at three different levels: Portfolio Manager, Contributor (Application or Domain), and Result Viewer.
The administrator. Has access to every page of the organization’s CAST Highlight instance — assigned to whoever sets up and maintains core aspects of the implementation.
- Creates and manages other user accounts
- Accesses analysis results for all applications in the instance
- Manages the scope of each campaign — which applications are analyzed, and by whom
- Oversees any survey customization
- Can download the Code Reader and analyze applications on behalf of application owners
Attached to a domain, and can contribute to any application attached to that domain.
- Uploads scan results and answers surveys for all applications of the domain
- Has visibility on all application results of the domain
- Can download the Code Reader and analyze applications
Contributes only to the applications where he/she has been specifically added as a contributor.
- Uploads scan results and answers surveys for assigned applications only
- Has visibility only on results of assigned applications
- Can download the Code Reader and analyze applications
Typically assigned to an executive member of the organization. Attached to a domain.
- Accesses results for all applications of the domain — attached to the root domain, the user sees the whole portfolio
- Cannot download the Code Reader, analyze an application, or complete surveys
Access rights at a glance
| Capability | Portfolio Manager | Domain Contributor | Application Contributor | Result Viewer |
|---|---|---|---|---|
| Manage users, domains & applications | ✓ | — | — | — |
| Manage surveys & campaigns | ✓ | — | — | — |
| Download Code Reader & analyze | ✓ | ✓ | ✓ | — |
| Upload results & answer surveys | On behalf of owners | Domain’s applications | Assigned applications | — |
| View results | All applications | Domain’s applications | Assigned applications | Domain’s applications |
New User Set-up
First-time log in, account settings, and the password & authentication policy applied to your organization.
First-time log in
All first-time users of CAST Highlight receive an account activation email.
Click the activation link to activate your account on the CAST Highlight portal.
Enter a password to complete the activation process. You are then redirected to the CAST Highlight home page.
Log in with your credentials to enter the portal.
Account settings
The account settings view lets you manage your login credentials and verify your access rights.
- Your name is displayed on the top right-hand side of the portal.
- Click the user icon to display the user side menu.
- Select My Account.
Security & password policy management
To guarantee the security of the platform and support your internal security policy, you can decide the strength level user passwords must meet. These settings are defined at company level.
- Minimum length of 14 characters
- At least one alphabetic character
- At least one lower case character
- At least one upper case character
- At least one numeric character
- At least one special character (e.g.
#-?@) - Extended minimum length to comply with your policy (e.g. 14 characters)
Specified by the CAST Highlight platform administrator for companies that require stronger passwords for third-party solutions.
In the current version of Highlight, stronger password criteria don’t apply to users who have already defined their password. You can request a modification of your password criteria at any moment by contacting CAST Support at https://help.castsoftware.com.
Alternatively, user authentication can be done through SAML2/SSO integration with your organization directory. Follow the instructions in this tutorial.
Domain, Application & User Management
Create, update and delete domains, subdomains, applications and users — all from the same screen.
Users assigned to Contributor roles can skip ahead to Analyzing Source Code. All features in this part are found in the Plan section of the CAST Highlight portal.
| User | Role |
|---|---|
| a.martin@company.com | Application Contributor |
| k.sato@company.com | Domain Contributor |
| cio@company.com | Result Viewer |
For further guidance on portfolio management features, see the product tutorial: Feature focus: portfolio management optimization.
For SSO/SAML-configured CAST Highlight instances, see CAST Highlight SAML/SSO integration with identity providers (IdP).
Survey Management
Surveys collect valuable input from application owners about each application analyzed by CAST Highlight.
Setting up a survey
To access survey management features, go to the Manage Portfolio section and click Manage Surveys. Two kinds of survey are available:
- CAST standard surveys — provided by CAST. You can use them and override/customize their labels for your application campaigns.
- Custom surveys — created and administered by Portfolio Managers within your organization.
All active surveys that can be used for a campaign are listed in the right panel (Active Surveys). Unfold them to view questions, remove them, or make them mandatory — except for CAST standard surveys, whose content is locked. To customize a CAST standard survey, clone it first.
- Override survey labels (e.g. translate descriptions into another language)
- Remove a question from a survey
- Make a question mandatory
CAST standard surveys
The platform uses responses to the CAST standard surveys to generate a Business Impact indicator, a Cloud Maturity indicator, a Green Impact indicator and a Software Maintenance Estimate for each application. The Portfolio Manager sets up the survey; the Contributor — typically the application lead — answers the questions and runs the code analysis.
- Category — COTS (Commercial Off The Shelf), custom application, customized COTS, or integration code?
- Type — CRM, ERP, Consumer Lending application, etc.?
- Initial release year — when was the application first implemented?
- Required to generate the Business Impact index
- Can be de-activated or customized
- Question and answer weighting can be customized — see this tutorial
- Required to generate the Cloud Maturity indicator
- Can be de-activated or customized
- Question and answer weighting can be customized — see this tutorial
- Required to generate the Green Impact indicator
- Can be de-activated or customized
- Question and answer weighting can be customized — see this tutorial
- All six are required to generate the Software Maintenance Estimate
- Can be de-activated entirely
For CAST Highlight to generate the Software Maintenance Estimate, the Contributor must complete both the Business Impact and Software Maintenance Estimate questions.
De-activating a CAST standard survey
If your organization wants, for instance, to focus exclusively on source code analysis, you can remove the survey — or parts of it — from CAST Highlight.
Navigate to the Manage Surveys tab under the Manage Portfolio section.
On the left panel, click the link icon of the survey section to remove it from your CAST Highlight instance.
You can’t remove a single question from a standard section — only full sections. A removed section can be re-activated at any time by clicking the + icon for the corresponding survey in the Survey Catalog tab.
Custom surveys
A custom survey is an excellent way to gather additional information on your applications and build analytics that complement the standard CAST indicators.
In Manage Portfolio › Manage Surveys, click + Create Survey in the left panel. Enter a name and description, then click Save. The new survey becomes available across your organization.
In the right panel, select the Questions tab, which lists existing questions. Click + Create Question, type the question, choose the answer format (Text, Number, Percent, Date or Multiple Value), and click Save. Questions can be edited or deleted at any time with the edit and delete buttons.
Tick the checkboxes of the questions you want to include, then click the file icon of the survey to attach them. Questions can’t be attached to a CAST standard survey.
Click the star on the right-hand side of a question — a lit star means the question is mandatory.
Once your survey and its questions are ready, you can use it for a campaign.
Campaign Management
A campaign is a set of applications to be analyzed at a specific point in time.
Launching a campaign lets the Portfolio Manager send a communication through CAST Highlight to all registered team members, notifying each user that they should start analyzing their source code.
Applications must be associated with a campaign for Contributors to be able to conduct the analysis and complete the survey. All applications to be added to a campaign must first be created in the Manage Applications tab — see Domain, Application & User Management.
Creating and launching a campaign
Navigate to the Manage Campaigns tab under the Manage Portfolio section and click Create Campaign.
Name — displayed in the portal (e.g. “January Campaign”, “Business Services Campaign”).
Closing Date — Contributors can’t submit results after this date.
Domain and Application scope — which applications will be analyzed in this campaign.
Click Next Step to see the launch message, which is emailed to all users associated with the applications in the campaign. Customize it as you like — up to 1,024 characters.
Click Complete. Each user receives the launch email.
Hello, the Q4 portfolio assessment is now open. Please scan your application’s source code with the CAST Highlight Code Reader, upload the results and complete the survey before the closing date.
Analyzing Source Code: Overview
Who this section is for, and how the Code Reader fits into a CAST Highlight assessment.
This section of the guide is designed for team members with a Contributor role — typically application owners. If your team wants to leverage automation capabilities instead of the desktop app, the same analyzers are available through the CAST Highlight Command Line Interface (CLI), which integrates into CI/CD pipelines.
Install the Code Reader → define your scan scope → run a scan → upload the result ZIP to the portal → complete the survey → submit. Each step is covered below in order.
Installing the Code Reader
Download the Code Reader from here: https://doc.casthighlight.com/codereader — always grab the latest version.
Unified experience across operating systems (Windows, Linux, Mac).
Version 1.0.2 x64 (94MB)
Debian · 1.0.2 amd64 (70MB)
Fedora · 1.0.2 x86_64 (70MB)
Version 1.0.2 x64 (70MB)
Download the binary that corresponds to the operating system where the Code Reader will be installed, then follow the installer wizard steps. The Code Reader is packaged with Perl and the CAST Highlight CLI, both required elements.
Perl and additional modules might be required. Check the prerequisites before installing.
Prefer automation? Download the CAST Highlight CLI instead — it contains the same analyzers as the Code Reader and integrates within your CI/CD environment. See the Command Line (CLI) section below.
Define Your Code Scan Scope
A few minutes of prep now saves rework later — the Code Reader treats every file in scope as equally part of the application.
CAST Highlight analyzes code at the file level and doesn't evaluate logical links or dependencies between files — every file inside the scan scope is treated as part of the application. To get accurate, consistent results, use the folder/file exclusion features to prepare your scope first.
- Open source & COTS packages — include the folders that contain them if you want to identify them (often grouped under a
third-partysubfolder, with main code undersrc/main). - Test classes — exclude them unless you specifically want them scanned.
- Generated code (e.g.
*.t.ds,*.flow.js) — exclude it, since the development team can't manage the health of auto-produced code. - SCM, build & deployment folders (e.g.
.git,.svn) — exclude for more consistent results. - Dependency manifests (e.g.
pom.xml,build.gradle,package.json,.vcsproj) — keep these in scope if you want framework and dependency insights.
If you scan a whole C:\ drive, Highlight will systematically scan every file it can with its 40+ supported technologies and try to consolidate insights from there — the few minutes spent scoping the application up front are saved many times over when consuming the analytics later.
Running the Code Reader
Launch, discover, and let the Code Reader do the scanning.
Click the CAST Highlight Code Reader shortcut on your desktop.
Add one or multiple folders containing your source code to be discovered by the Code Reader.
Click "Launch Scan" once your folder selection is ready. You can cancel discovery at any time.
Once complete, review the technology summary, then save results as a ZIP ready for upload.
| Technology | Extension | # Files | Status |
|---|---|---|---|
| Kotlin | .kt | 1560 | Analyzed |
| Ksh | .sh | 4 | Analyzed |
| — | conf | 73 | Not Supported |
| — | configloader | 1 | Not Supported |
Once the scan is finished, you can:
- Save Results — produces the ZIP file you'll upload to the SaaS platform for the corresponding application.
- Open / Save scan logs.
- Re-scan the selected folder, or go back to the initial screen to scan another folder.
- Save scan settings (a
.propertiesfile) to ease future automation through the CLI.
Common reasons a file is excluded
- Binary file
- Unreadable file
- Missing file
- External library
- Encoded file
- Generated file
- Syntax error
- Content not in expected language
- Code not compliant with analysis criteria
- File too big (limit is 3 MB)
- Time out
- Analyzer not available
- Some analysis unit is not OK
If your files use extensions that don't match what the Code Reader detects, rename them to match — see the Best Practices and Languages & Extensions sections below. If you hit an issue, save the analysis logs and share them with CAST Support.
Advanced Settings
Fine-tune a scan from the "Advanced Settings" button on the initial screen.
- Select specific technologies to include during the scan.
- Unspecified technologies are ignored — leave blank to scan all supported technologies.
- Ignore Directories, Files, or Paths
- Match by name or extension, or use regular expressions
- Server URL, Company Identifier, Application ID
- Snapshot Label & Date
- User Login / Password / Token
- Automatically upload results for an application once the scan completes
- Create Cloud/Green insights file for importing into IDEs
- Enforce scan of large files (>3MB)
- Include all NPM dependencies on lock files
- Enforce scan of generated code
These settings are shared with the Command Line and can be retrieved from the Command Line (CLI) section below. Reset to default values at any time with "Reset Configuration".
Uploading the Results
The Code Reader produces a ZIP of anonymized CSV files — upload it to the portal to populate results.
Under the Application Scans section, look for the application you analyzed.
Click "Upload Results" and point to the result ZIP file saved by the Code Reader.
Once uploaded, you'll see a record on screen. You can also upload result .csv files one by one.
An analysis results file can be deleted at any time during the upload process via the trash-can icon. A Contributor removing their own results will need to re-enter their password to validate the action; the Portfolio Manager can remove any file.
Answering Surveys
If surveys are activated for your organization, complete them before submitting.
- Under Application Scans, click the campaign, then the application.
- Click the "Survey" button and answer the questions for each section.
- If the survey is de-activated for your organization, simply click "Submit" — you're finished.
Survey progress is shown at the top of the screen. Once all mandatory questions are answered, you can submit your results — though answering every question enriches your organization's CAST Highlight data.
Submitting the Results
- Once all required CSV files are uploaded and any mandatory survey questions are complete, click "Submit" on the application under Application Scans.
- This step is required to populate results in the portal.
Once submitted, a Contributor can no longer make changes — only the Portfolio Manager can modify an application after results are submitted. If the analysis needs to be redone, contact your organization's Portfolio Manager (or CAST Support if you don't know who that is).
Command Line Interface (CLI) v5.12.18
Run the exact same analyzers as the desktop Code Reader from a Java binary — scriptable, CI/CD-friendly, and UI-free.
The CAST Highlight command line (HighlightAutomation.jar) is a Java binary that enables automated source code scans inside CI/CD environments. It replaces the Code Reader's desktop UI with fully scriptable options, so continuous software health and cloud readiness monitoring can run unattended on every build.
Requirements
- Supported major JDK releases: 11, 17, 21
- Pre-release versions are not supported
- Perl 5.xx with libraries:
Digest::SHA,XML::LibXML,JSON,Time::HiRes,Math::BigInt
- Strawberry Perl 5.42.0.1 installation required
- Running the CLI inside a Docker container is recommended
Version 5.12.18 is available for download after accepting the end-user license agreement, from the Application Scans section of the portal.
Core Syntax
Mandatory Options
| Option | Description |
|---|---|
| --sourceDir | Absolute path to the source code directory to scan. Repeat the flag to scan multiple folders in one pass. |
| --workingDir | Absolute path to the Highlight working directory, where scan results and logs are stored. |
Scan Options
| Option | Purpose |
|---|---|
| --propertiesPath | Path to a centralized .properties configuration file. |
| --technologies | Comma-separated list of specific languages to scan (e.g. Java,Python). |
| --ignoreDirectories | Directory patterns (regex) to exclude during the scan. |
| --ignorePaths | Regular expressions to exclude paths, separated by |. |
| --ignoreFiles | File patterns (regex) to exclude from scanning. |
| --analyzerDir | Alternate analyzer scripts directory. |
| --perlInstallDir | Windows-only: path to the Perl installation directory. |
| --keywordScan | Path to a KeywordScan XML configuration file. |
| --analyzeBigFiles | Bypass the default file size limitation (3 MB). |
| --allowGeneratedCode | Include generated code files (e.g. *.designer.vb, *.designer.cs). |
| --packageManager mvn | Native Maven integration for dependency resolution. |
| --mavenRepository | Local .m2 repository path for Maven components. |
| --nugetRepository | Local Nuget cache path for .NET dependencies. |
| --includeAllDependencies | Include indirect dependencies (e.g. from node_modules). |
| --includeArchiveContent={depth} | Extract and scan archive contents down to the specified depth. |
| --dockerImageNameTag {name#tag} | Scan a Docker image directly, by image name and tag. |
| --fingerprints | Enable fingerprint matching for open-source component detection. |
| --excludeInferredCVE true/false | Disable CVE detection that relies on component name matching. |
| --dbgMatchPatternDetail | Generate detailed files used for VS Code plugin integration. |
Git Repository Options
| Option | Purpose |
|---|---|
| --gitUrl | GitHub or GitLab repository URL to scan directly, without checking it out yourself. |
| --gitBranch | Branch to download. Defaults to main when omitted. |
| --gitToken | Authentication token, required for private repositories. |
| --gitType | Git server type, e.g. gitlab for a locally-hosted GitLab instance. |
Upload Options
| Option | Purpose |
|---|---|
| --login | Email of an active CAST Highlight user account. |
| --password | Password for the account above. |
| --basicAuth | Base64-encoded credentials, as an alternative to login/password. |
| --tokenAuth | OAuth token for authentication — the recommended method, and required for SSO/SAML organizations. |
| --companyId | Company identifier, taken from the portal URL. |
| --applicationId | Application identifier, taken from the portal URL. |
| --serverUrl | URL of your CAST Highlight server instance. |
| --snapshotDatetime | Epoch timestamp in milliseconds to assign to the snapshot. |
| --snapshotLabel | Snapshot label (e.g. a version or build number). |
| --skipUpload | Generate CSV results only — don't upload them. |
| --appendResult | Add these results to an existing upload rather than replacing it. |
| --skipSubmit | Upload the CSVs without triggering platform processing. |
| --zipResult {path} | Create a ZIP file containing the result CSVs at the given path. |
| --uploadZipFile {path} | Upload a previously-scanned ZIP without re-scanning the source. |
Utility Options
| Option | Description |
|---|---|
| --help | Display all available options. |
| --printTechnos | List all supported technologies. |
If your CAST Highlight instance uses SSO/SAML, authenticate with --tokenAuth (a user token) instead of --login / --password — basic credentials aren't accepted.
Usage Examples
Default Excluded Directories
The CLI automatically skips these common directories, so you rarely need to list them yourself with --ignoreDirectories:
.git* .svn .circleci .scannerwork .azure .vscode test/ tests/ sample/ samples/ example/ examples/ demo/ __MACOSX/ .DS_Store debug/ /obj/Release/ /obj/Debug/ /bin/Release/ /bin/Debug/ node_modules/ vendor/ packages/ Pods/ bin/ build/ dist/ out/ target/ mocks swagger karma e2e
Default Excluded Files
Test and flow files are excluded by default:
*.t.ds *.flow.js *.spec.ts *.spec.js *-spec.js *.specs.js *-specs.js
Exit Codes
| Code | Meaning |
|---|---|
| 0 | Success |
| 1 | General failure |
| 2 | Options parse error |
| 3 | Technology discovery error |
| 4 | Analysis error |
| 5 | Upload error |
| 6 | Source/output directory validation error |
| 7 | ZIP file save error |
| 8 | ZIP file upload error |
Output
A log file named HLAutomation.log is created in the working directory after each run. Scan results are generated as CSV files under HLTemporary/analysis/, and discovery logs are written to HLTemporary/discover/.
Best Practices by Technology
Language- and database-specific tips to get clean, analyzable results.
- Use the CAST extractor to compile ABAP source files before analysis.
- Benefits: validated with Code Reader, automatically splits files as required, and handles extracted files without manual extension changes.
- A different extractor can be used, but you'll lose the above advantages.
- Third-party libraries and minified files (
filename.min.js) aren't fit for health analysis. - They're auto-detected and excluded, but stored separately in
*.ThirdParties.csvfor Software Composition Analysis.
- Supports KSH (
.ksh), Bourne (.sh) and Bourne Again (.bash). C-Shell is not supported. - Two scan options differ by file filtering:
.kshonly, or*(all files — recommended, then hand-pick files to analyze).
- Recommended: use the CAST extractor. Source provided via
.pkb,.pks, or.psql. - A single
.sql/.psqlfile is auto-split into functions, procedures & triggers; code outside routines is analyzed as a "root" artifact. - Non-procedural code is excluded. DB extractors produce
.srcby default — rename to.psqlfor best results.
- Recommended: use the CAST extractor, which splits T-SQL files by artifact (procedures, functions, triggers) per file.
- Procedural code outside an artifact is a "root" artifact and is also analyzed; non-procedural code is excluded.
- Rename default
.srcoutput to.tsqlfor best results.
- Light analyzers — calculate lines of code (LOC) only, after code/comment separation. No procedural distinction, no Software Health rules.
- Use
.db2,.mysql, or.mariadbextensions respectively for best results.
- Non-procedural code is excluded from analysis (like PL/SQL).
- Use the
.postgresqlextension to explicitly associate files to the PostgreSQL analyzer.
- The Code Reader does not distinguish VB.NET, VB5 and VB6 — extensions and syntax are very close, but it is optimized for VB.NET.
- VB Scripts (
.vbs) are not supported.
- Only include source code in the scanned folder — e.g. exclude copybooks / JCL from a COBOL analysis, keep just the programs.
- Alternatively, select a folder with mixed assets and check/uncheck individual files.
- Highlight rejects non-source assets automatically, but this can slow down analysis time.
Languages & File Extensions
Rename source files to match a recognized extension for the most accurate analyzer routing.
| Language / Technology | Type | Source File Extensions & Notes |
|---|
No technologies match your search.
Binary extensions considered for Software Composition Analysis
CAST Highlight's analyzers also take binary extensions into account to help detect third-party components: .jar (Java), .dll (Windows), .a, .lib, .so. After a scan, binary file information is stored in a separate result CSV (BinaryLibraries.csv) which needs to be uploaded along with the other CSV results.
Structure & Definition of the Analysis Output File
Every output file has three segments: Output File Attributes, Section Attributes, and File Attributes.
Customer data is never sent over the internet by e-mail or any other protocol. The result of the code-level analysis performed by the Code Reader on client infrastructure is uploaded to the website over HTTPS and encrypted in transit using a 256-bit encryption mechanism. The Code Reader produces several types of CSV result files — all readable, so feel free to open them and inspect their structure and content.
Generated Result Files
Every file listed below contains only anonymized, encoded metrics (e.g. Id_123 counts, file names, and cryptographic hashes) — never source code content. Insights such as risk ratings, licenses, obsolescence, and vulnerabilities are resolved and consolidated only after upload, on the CAST Highlight platform.
| Result | Generated File | Content |
|---|---|---|
| Software Health | {TechnologyName}-{Timestamp}.csv | Code insights (metrics are anonymized, resolved/consolidated once uploaded to the platform) |
| Cloud Maturity | {TechnologyName}-{Timestamp}.CloudReady.csv | Cloud insights (metrics are anonymized, resolved/consolidated once uploaded to the platform) |
| Green Impact | {TechnologyName}-{Timestamp}.GreenIT.csv | Green insights (metrics are anonymized, resolved/consolidated once uploaded to the platform) |
| AI Insights | {TechnologyName}-{Timestamp}.AI.csv | AI Opportunity insights (metrics are anonymized, resolved/consolidated once uploaded to the platform) |
| Agentic Readiness | agentic_readiness.json | Agentic Readiness insights |
| Packages & Dependencies | framework.validated.csv | Declared dependencies from package management files (Maven, NPM, Poetry, etc.) with detected/resolved versions — SCA insights are resolved/consolidated once uploaded to the platform (licenses, obsolescence, vulnerabilities, etc.) |
| Binary Libraries | BinaryLibraries.csv | Binary file (JARs, DLLs) information (file name and SHA256) — SCA insights are resolved/consolidated once uploaded to the platform (licenses, obsolescence, vulnerabilities, etc.) |
| Third Parties | {TechnologyName}-{Timestamp}.ThirdParties.csv | File name and SHA256 of files considered as third-party components (e.g. minified JavaScript libraries) — SCA insights are resolved/consolidated once uploaded to the platform (licenses, obsolescence, vulnerabilities, etc.) |
| Technologies | AppDataDetails.csv | Files that reference specific technologies and detected versions (JDK, .NET, Spring Boot) — insights are resolved/consolidated once uploaded to the platform (obsolete technologies) |
Output File Attributes
| Attribute | Definition |
|---|---|
| app_version | Identifies the version of the analyzed application |
| version_count | Identifies the version of the Code Reader |
| app_type | Identifies the type of analysis |
| base_name | Output file name as specified by the user |
| csv_base_filename | Output file name |
| version_Highlight | CAST Highlight Code Reader version number |
| start_date | Analysis date |
| uuid | CAST Highlight UUID identifier of the current file |
Section Attributes
The section data defines the file structure for the specific analyzer along with additional analyzer attributes. Scan metrics are anonymized (e.g. Id_123) and decoded by the portal once the file has been uploaded.
File Output Structure Example
File Output Attribute Definitions
| Attribute | Definition |
|---|---|
| Dat_FileName | File name |
| Dat_Language | Programming language analyzed |
| Dat_AnalysisDate | Date of the analysis |
| Dat_CRC | Legacy fingerprint based on file content |
| Dat_SHA256 | Fingerprint based on content |
| Dat_AnalysisStatus | Reports the analysis status |
| Dat_AbortCause | Reports the cause of failure |
| Dat_AnaModel | Reports the model of the count |
| Dat_Lines | Number of lines of code analyzed |
| Nbr_Lines | Number of lines of code analyzed |
| Id_# | Reports alarm counts against specific rules per analyzer. Parsed as part of the reporting process to derive CAST Highlight risk ratings. |
A file summary is generated for each file analyzed, following the Section format above. Example:
Code Scan Troubleshooting & Support
Known Limitations
If you're scanning files whose full path (directories + file name) exceeds 260 characters, the scan will likely interrupt. Workaround: reduce the length of the path.
Save analysis logs with "Save Logs for Support" and share them with the CAST Support team for the fastest resolution.