A scan is one run of Norma’s analysis engine against your code on a specific branch. Every scan produces three things: a Production Ready Score, a list of issues, and a coverage summary showing which scanners ran.
When scans happen #
- Automatically on first import. When you connect a new repository, Norma runs an auto-discovery (detecting your tech stack) and a first scan back-to-back — you don’t click anything in between. See Connect your first repository.
- On demand, any time after that. Click Run Scan from the repository card on the Repositories page or from the top-right button on any repository’s Overview tab. See Running a scan.
Automatic scans on every push (multi-branch scanning) are on the roadmap but not in the July 2026 release. Today, you trigger every re-scan manually.
What a scan produces #
Every scan, successful or failed, leaves three artefacts on the repository:
- Production Ready Score — a single 0–100 number plus a READY / NOT READY label derived from it. See Production Ready Score.
- Issues — every rule violation found, with severity (High / Medium / Low), impact area (Security, Performance, Architecture, Maintainability, Scalability, Manageability), file, line, and a recommended fix. See Reading results.
- Coverage — which scanners ran, which rules executed, and which were excluded. Useful when you want to know why something wasn’t caught.
Scan duration #
Scans typically complete in 1–5 minutes for a small-to-medium repository. Large monorepos can take longer. The Repositories page card shows a Scanning… state while a scan is running; you can navigate away and the scan continues in the background.
Scan history #
Every scan is stored, including failures. The most recent scan is what the Overview tab and Issues tab show by default. Earlier scans are available from the Execution History view of the repository (linked from the repository detail page).
This gives you a trend over time — for example, “we shipped 12 new High-severity issues in the last 30 days” — and lets you compare the current scan with any previous one.
What scans don’t do #
- They don’t change your code. Scans are read-only. Norma does not push fixes, open pull requests, or modify any file on your provider.
- They don’t keep your code. A scan clones your repository, analyses it, and deletes the clone the moment the scan finishes. Only the findings (issues, score, coverage) persist on Norma’s side.
- They don’t run automatically on push (yet). That’s multi-branch scanning, which is on the roadmap.
Quota #
Your tier sets a weekly scan limit:
- Free — 3 scans per week.
- Pro — higher (see Tiers and quotas).
The Repositories page shows how much of your quota you’ve used, and when the next reset is. Run Scan is disabled when you’re at quota, with a tooltip pointing you to upgrade.
Related #
- Running a scan — how to trigger one manually.
- Reading results — making sense of the Issues tab.
- Production Ready Score — what the score means and how it’s calculated.
- Supported languages and frameworks — what gets analysed during a scan.
