Exit codes and error handling ↗

The Cortex Unified CLI has standardized exit codes categorized by application states, error suppression flags, and specific modules. Use this guide to configure and troubleshoot your CI/CD pipelines.

Standard CLI exit codes

Exit Code	Constant / Representation	Description
0	ScanSuccess	The scan executed successfully and no security findings were found
1	ScanFailed	The scan completed with findings (e.g., findings blocked by AppSec policy), or a general operational failure occurred
2	ScanExecutionFailure / InternalError	An execution error occurred, version mismatch was detected (local version is strictly greater than the backend version), or a CLI usage/configuration error was encountered

---

Exit code suppression flags

The CLI provides two global flags to control and suppress exit codes in automated environments:

• --soft-fail: Converts exit code 1 (findings with blocking policy) to 0
• --no-fail-on-crash: Converts exit code 2 (internal/execution error) to 0

Module-specific exit codes

Attestation module

• 1 (exitOperationFailed): Returned when a cryptographic or attachment operation fails (e.g., signing failed, verification failed, register/delete/update key failed, failed to render output).
• 2 (exitUsageError): Returned for user configuration/usage errors (e.g., missing required flags like --image or --key, invalid flag values).

Code security module

• 2 (casExtractErrorCode): Returned when the runner fails to extract the underlying APPSEC engine, failed to acquire lock, failed to validate signature, or during timeout execution.