Reference

The reference pages are generated from the untrust source by docs-site/tools/gen_reference.py, so they match what the scanner actually runs. They are the same catalogs the console shows under Help › Docs.

Page	Contents
CLI commands	Every documented command and option, from the CLI's own --help.
Required permissions	The cloud permissions each platform's scan uses, read from the scanner's code, with example IAM policies and roles.
Scan inputs	Which untrust scan option each check reads, so you know what to add to cover a check.
Configuration and environment variables	Every environment variable the CLI reads, where settings come from, credentials and network behaviour.
Support matrix	Checks, active checks, detection rules and CI rules per platform.
Checks	Every posture check, each on its own page: severity, platform, what a failure enables, how to fix it, its inputs and permissions, and why it can be skipped.
IaC rules	Every rule untrust iacscan evaluates, by input format.
Build rules	Every source-analysis rule untrust buildscan runs.
Detection rules	Every runtime detection rule, its log source and related check.
Policies	The built-in governance policies and which are release gates.
Report and evidence formats	The fields of every JSON file the CLI writes or verifies: scan reports, receipts, registry reports, detection events, evidence packs and ledger entries. Written by hand from the code, not generated.

Severity

Severities are critical, high, medium, low and info. The CI gates block on findings at or above --fail-on (default high). An organization can change a build or IaC rule's severity and enforcement within limits; see Rule levels.