Frogbot V3

JFrog Frogbot is a Git-based bot that shifts security left by detecting and fixing vulnerabilities in your pull requests and commits. It leverages Software Composition Analysis (SCA), Static Application Security Testing (SAST), Infrastructure as Code (IaC) scanning, and secrets detection to catch risks before they reach production.

Frogbot V3: What's New

JFrog Frogbot V3 introduces centralized configuration management, a cleaner API, and enhanced scanning capabilities—powered by a new Static SCA Engine. This shift to static analysis improves reliability, simplifies setup, and expands visibility across your software supply chain.

If you are upgrading from V2, here are the key changes:

• Static, Build-Independent Scanning: Scans are performed without executing package managers or requiring a build environment, ensuring consistent results even when builds fail.
• Zero-Configuration Project Detection: Automatically detects project structures, including nested and multi-package repositories, with no manual setup required.
• Enhanced Platform Visibility: Scan results are uploaded as CycloneDX (CDX) SBOMs to the JFrog Platform, enabling features such as transitive SBOM tree views and improved remediation insights.
• Unified Scanning Experience: All Git repository scan results are consolidated into the Artifactory Scans List, providing a single view across source code and binaries.

Centralized Configuration via JFrog Platform

The biggest change in V3 is that Frogbot can now be configured entirely from the JFrog Platform UI instead of relying solely on per-repo frogbot-config.yml files and environment variables. Configuration is managed through Config Profiles that follow your SCM hierarchy:

• Server-level configurations apply to all folders and repositories on the server.
• Folder-level configurations override server settings and apply to all sub-folders and repositories within.
• Repository-level configurations override folder and server settings and apply only to that repository.

Settings are inherited downward automatically, so newly added repositories and folders pick up the parent configuration without manual setup. Each entity shows its configuration status: Default (system defaults), Custom (directly configured), or Inherited (using a parent's configuration).

At the repository level, you can split a Git repository into workspaces. Each workspace is a named scan unit with its own configuration profile, so a monorepo can scan and configure applications independently. Every repository includes a default workspace. For more information, see Manage Frogbot Workspaces.

New Scanning Capabilities

• Snippet Detection (SCA) — Detects code snippets copied from open-source projects, even when not installed as a dependency. Available at the repository level.
• Dynamic Token Validation (Secrets) — Validates detected secrets against live services to confirm whether they are active and exploitable.
• Custom Secrets Scanning — Scan for organization-specific secret patterns beyond the built-in rules.
• SAST Rule Exclusions — Exclude specific SAST rules from scans to reduce noise for known false positives.

Before You Begin

• Ensure That your Xray Version is 3.143.6 or Later
• Meet the system requirements
• Ensure your environment has: Git, curl, and Unzip
• Before running Frogbot V3, ensure the repository has been scanned and the required build artifacts have been generated for your package manager.
• The initial Frogbot V3 setup requires administrator permissions to create the Frogbot repository that stores SBOM scan results, unless you pre-create that repository. After the repository exists, Frogbot requires Deploy permission on the Frogbot repository, in addition to standard repository access.

For Self-hosted installations:

• Ensure you have Catalog Service installed and available
• Ensure you have Transitive SBOM enabled

Pre-create the Frogbot Repository

If you don't want to grant administrator permissions to the pipeline runner, create the Frogbot repository in Artifactory before the first scan.

To pre-create the Frogbot repository:

1. In the JFrog Platform, create a Generic local repository.
2. Name the repository frogbot. If you create the repository inside a Project, name it <project-key>-frogbot.
3. Go to Administration > Xray Settings > Indexed Resources and add the repository.
4. Grant the Frogbot identity Deploy permission on the repository.