How to add a target in Cyberlop: the New target dialog, field by field

To add a target in Cyberlop, open Targets, click + New target, enter a Name and Main URL, choose White-box or Black-box, set the Environment and click Create target. A target is the application you want assessed. The dialog is short, but you cannot change several of its choices later, so read this guide first.

What is a target in Cyberlop?

A target is the application under assessment: a name, a Main URL, optional backend URLs, a repository URL and branch for white-box scans, an environment and a team. Every scan profile, scan and finding hangs off a target, so it is the first object you create. Key terms collects the vocabulary.

It pays to register the right app carefully, because software flaws are a common way into organisations. Verizon's 2026 Data Breach Investigations Report found that 31% of breaches began with software vulnerabilities, a bigger share than stolen passwords.

Add only systems you own or have permission to test. NIST SP 800-115, a guide to technical security testing, puts planning first, and that planning includes agreeing the scope and the rules of engagement before you register anything.

What do you need before you add a target?

You need permission to create targets, a name for the app, its URL and a decision on scan type. For white-box you also need an HTTPS repository link and the branch that matches what is deployed at that URL.

Pre-flight checklist

1. Permission. If + New target is missing, your role lacks the permission to create targets. An administrator manages roles in Administration, which this guide does not cover.
2. Authorisation. Confirm you own the app or hold written approval to test it.
3. A safe first environment. Pick a Dev or Staging copy for a first scan, ideally one without real customer data.
4. The scan type. White-box if you can share the code, black-box if you can share only a URL.
5. A Git token if the repository is private. See Connect a repository.
6. Room on your plan. How many targets you can hold depends on your plan and is shown in Settings → Plan & usage.

Why a staging copy makes a good first target

A test environment kept apart from real users gives the scan room to work. Dev and staging exposure is the opposite risk, so keep non-production copies private. For the safety questions that matter on a live system, read Exploitation phase before pointing a scan at production.

How do you add a target, step by step?

Adding a target is a single-step dialog with no wizard. Work down the fields in order and finish with Create target.

1. Open Targets in the sidebar. The page lists your applications, with search, Export JSON and Export CSV, and + New target at the top right.
2. Click + New target. The dialog title is "New target" and its subtitle says "Register an application to scan."
3. Type a Name and the Main URL.
4. Optionally list Backend / additional URLs, one per line or separated by commas.
5. Choose a Scan type card: White-box or Black-box.
6. For white-box, enter Repo URL (HTTPS) and check Repo branch.
7. Set the Environment and, if you wish, a Team.
8. Click Create target, or Cancel (or the close button) to leave without saving.

New target field reference

This table lists every field in the dialog, in the order it appears.

Name and Main URL

Use a name your team will recognise in lists, scans and reports. For the Main URL, use the address the app itself answers on, for example https://staging.example.com, not a marketing page. The dialog describes it as the primary URL that scans run against.

Backend and additional URLs

If the app talks to separate API or admin hosts, list them here. The placeholder shows an api. host and an admin. host on separate lines. This widens the attack surface the target covers, so add only hosts you have permission to test.

White-box or black-box: which scan type should you choose?

Choose white-box when you can provide the source repository, because Cyberlop then reads the code while it tests the running app. Choose black-box when you can provide only a URL. You cannot edit a target after creation, so decide before you click Create target.

Cyberlop also reaches pages behind a sign-in, which gives a grey-box style view. That is not a third card in this dialog: you add login details later, as authentication roles on the scan profile. White-box vs black-box scans compares the types in more depth, and Authentication roles shows how logins work. The background terms are white-box, black-box and grey-box testing.

How do you set up a white-box target?

A white-box target needs an HTTPS repository URL and a branch. A scan clones public repositories when it launches. Private repositories need a Git token for an allowed host, and SSH git@ links are not supported.

1. Select the White-box card. The Repo URL (HTTPS) field carries a required mark.
2. Paste the HTTPS link to the repository, for example https://your-code-host/your-team/your-app.
3. Leave Repo branch as main, or type the branch that is deployed at the Main URL.
4. If the repository is private, save a token first, as described in Connect a repository and Git access.

Match the branch to the deployed app

The scan clones the latest from the branch at launch and also tests the running app at the Main URL. If the branch and the deployment differ, a finding may describe code that is not running. Pointing both at the same release keeps the file and line in a finding relevant.

Where the source code goes

In a cloud scan, the repository exists only while the scan runs, and Cyberlop wipes it when the scan reaches a final state. A self-hosted agent keeps source on your own network. See Self-hosted scan agents and private scanning.

How do you set up a black-box target?

For a black-box target, choose the Black-box card, enter the Name and Main URL, and leave the repository fields alone. They grey out, and the help text reads "Not used for black-box scans." You must then prove ownership before a scan can run.

1. Select Black-box. The repository and branch fields grey out.
2. Choose the Environment and Team, then click Create target.
3. Open the new target. Its Ownership verification card shows the state.
4. Prove ownership by one of two routes: a DNS TXT record on your domain, or approval by Cyberlop staff.
5. When the badge reads Verified, the card says "Black-box scans can run."

A DNS TXT record is a DNS entry that holds free text, which is how RFC 1035 describes the TXT type. The exact record to publish is shown in the app, so this guide does not reproduce it. Full detail is in Verify target ownership.

Which environment and team should you pick?

Pick the environment the URL really is: Dev, Staging or Prod. Dev is the default, and the choice appears as a badge in the Targets list so people can tell copies apart at a glance. Team is a free-text label, optional, with the placeholder "Platform".

Naming that keeps the list readable

• Put the app and the environment in the name, such as "Orders staging" and "Orders prod".
• If the same app exists in two environments, register two targets, one per URL.
• Use the same Team spelling every time, so people can find each other's targets.

Production targets deserve extra care. The profile's exploitation setting decides whether the scan actively proves issues against the live app, so settle that with the owners of the system first.

What happens after you create a target?

Cyberlop saves the target and it appears in the Targets list. Open it to see the target detail page: a single scrolling page with a Target details card, an Ownership verification card for black-box targets, and a Scan profiles card with + New profile.

Check the target

The ▷ Scan button needs a scan profile, so your next step is to create one: Create a scan profile. When you later run it, Run a scan explains what happens.

Can you edit or delete a target?

You cannot edit a target. Targets are immutable: to change any setting, delete the target and create it again. The delete icon in the Targets list carries that warning in its tooltip.

What deleting removes

Deleting a target also deletes its scan profiles, schedules, scans and findings. Before you delete, download the latest PDF report with the document icon and use Export JSON or Export CSV if you want a copy of the results. Manage targets walks through the list, exports and the delete flow, and Export findings covers the files.

Catch mistakes before you click

Read the Main URL, repository URL and Environment aloud before Create target. A typo in the Main URL is an easy slip, and the only fix is to delete the target and start again.

Troubleshooting: common add-a-target problems

Most problems come from a missing permission, a repository that cannot be read, or an unverified black-box target.

The field-level validation messages of the New target dialog were not captured for this guide. If the dialog will not submit, check that you have filled in Name, Main URL and, for white-box, the repository URL.

What are the common mistakes when adding a target?

• Choosing white-box without a repository to hand. Pick black-box if you only have a URL, and plan for ownership verification.
• Using an SSH link. Only HTTPS repository URLs work.
• Pointing at production first. Start with Dev or Staging.
• Registering one app twice by accident. Check the Targets list search first.
• Forgetting the plan limit. Check Settings → Plan & usage before you add a batch.

Next step: connect a repository if you chose white-box, or create a scan profile to define what to test. New to the platform? Getting started shows the whole path, and how it works explains the pipeline.