I'm doing a CASA Tier 2 security self-assessment for an app as required by Google, since the app requests permission from users to access sensitive data from their Google account via OAuth. I'm using the Fluid Attacks standalone scanning tool (gitlab:fluidattacks/universe@trunk) to run a SAST scan on a node.js app which incorporates approximately 16,000 npm packages.

The scan has been running for nearly a week on an AWS t2.medium ec2 instance, and it has still not completed. The log output showed that it analyzed the packages fairly quickly and started the file scanning. Periodically it reports that a file is too big to scan and is being skipped. So I think it hasn't hung, although it's been a day or two since I saw one of those messages. It's running in a docker container, and I don't see any Results file yet on the file system inside the container. I started another scan on a separate ec2 instance a day later than the first one, with only 7,000 npm dependencies, and it's showing the same sort of log output and has not completed.

Can anyone validate whether this is within the normal range of expectations? The documentation said the scan could take a while, but I wasn't expecting a week. I'm wondering how long I should let it run before I decide it's just not working.

1 Answer 1


I ran into the same issue. I found the recursion_limit setting in config.yaml to be useful.

  recursion_limit: 100


This key is optional, but must be set to a positive integer. We recommend an initial value between 100-1000 in order to perform the first tests on a repo.

My initial scan was taking several days, after setting it to a low number, it completed in a few minutes. A good way to confirm everything else is configured correctly when setting up the scan.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .