Skip to main content
Version: 2608.1

Understanding the Product

1. Sparrow On-Demand Capabilities​

Sparrow On-Demand is an enterprise-grade, API-driven security analysis service designed to seamlessly integrate core security technologies—Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Dynamic Application Security Testing (DAST)—into your DevSecOps pipeline without the overhead of installing additional local software. Organizations can leverage this service via RESTful APIs or Software Development Kits (SDKs) to achieve continuous risk reduction.

Sparrow On-Demand delivers the following mission-critical capabilities:

🎯 Execution of Security Analysis
  • Analysis Request: Initiate security scans dynamically via the Analysis Request API.
  • Analysis Request Response: Receive instant synchronous confirmation once the analysis request is successfully processed.
  • Result Delivery (Callback): Receive asynchronous updates on the analysis progress or final security posture reports via the callback URL you provide.
📌 Analysis Status and Information Retrieval
  • Request Status Inquiry: Monitor the lifecycle of a specific Request ID.
  • Analysis Details Inquiry: Retrieve granular telemetry and status updates for a specific Analysis ID.
🔎 Analysis Result Download
  • Download Analysis Results: Extract comprehensive vulnerability reports and artifact files using a completed Analysis ID.
  • Download Detection Rules: Export the specific compliance and vulnerability detection rulesets applied during the scan.

2. Sparrow On-Demand Analysis Workflow​

Analysis Flowchart​

:::note Sparrow recommends conducting a Proof of Concept (PoC) using a sample project to validate authentication, request, and response flows prior to full enterprise deployment. :::


👤 INITInitialization
  • The system receives the analysis request and provisions the necessary computational resources.
  • Sparrow On-Demand utilizes auto-scaling architecture; it dynamically allocates an analysis worker upon request receipt.
📦 READYPreparation
  • The target asset is securely transmitted to the assigned worker.
  • For SAST or SCA, this includes the time required to clone the Git repository.
  • DAST skips this phase and proceeds immediately.
🔍 PRE_PROCESSPre-processing
  • The commencement of the core engine. The system validates target attributes and aggregates necessary metadata.
  • For SAST/SCA, the system scans the target footprint.
  • For DAST, it crawls the application to map accessible URLs.
🧠 ANALYSISAnalysis
  • The active vulnerability hunting phase.
  • SAST: Inspects the aggregated code against sophisticated issue detection rules.
  • SCA: Cross-references identified components against global vulnerability databases to flag known CVEs and license risks.
  • DAST: Executes a payload of simulated cyberattacks based on the crawled attack surface to identify runtime vulnerabilities.
🧾 POST_PROCESSPost-processing
  • Aggregates and normalizes the raw findings.
  • Results across SAST, SCA, and DAST are registered in the centralized database and compiled into structured artifact files.
✅ COMPLETETermination
  • The lifecycle concludes.
  • This state is reached whether the analysis succeeds, is manually aborted, or fails due to an exception.

3. Sparrow On-Demand Data Processing​

Data Flow Lifecycle​

User data in Sparrow On-Demand is used as follows.

👤 INPUTData Input
  • Users provide credentials (ID/Password or Token) via API/SDK/UI Kit.
  • These credentials are treated as transient secrets and are used with Read-Only permissions solely for the duration of the analysis.
📦 CLONEData Clone
  • The repository is securely replicated into an isolated, ephemeral container.
  • It utilizes git clone to fetch the specified branch, commit, or tag (defaulting to the latest commit of the main branch).
🧠 ANALYZEData Analysis
  • The Sparrow engine processes the cloned data exclusively within the ephemeral container.
  • Upon completion and generation of the report, the container is immediately destroyed.
✉️ RETURNData Delivery
  • If the user requests it, the progress status is delivered to the callback URL while the analysis is running.
  • If the user requests it after the analysis is complete, the generated analysis results are delivered.

Data Protection, Retention, and Deletion​

Sparrow On-Demand handles user data as follows.

🔒 PROTECTData protection
  • All communication uses HTTPS.
  • The container in which the analysis runs is created and deleted as an isolated environment.
  • Sparrow On-Demand accesses the user's repository and analysis data solely for the purpose of performing the analysis in the service.
📦 STOREData retention
  • The original code is deleted as soon as the analysis ends.
  • Analysis results are retained for 24 hours so that they can be downloaded, and are then deleted.
🗑️ DELETEData deletion
  • Analysis results can be deleted immediately if the user separately requests it.
  • Deleted data cannot be recovered.


4. Sparrow On-Demand 2604.1 Detailed Versions​

Engine versions​

Sparrow SAST v5.6.2605.1, Sparrow DAST v2.6.2605.1, Sparrow SCA v1.6.2605.1

SDK versions​

Java 4.0.0

Node 1.2.0

UI Kit version​

1.2.1

MCP version​

1.1.14

Result version​

v2

Release date​

2026-09-03