Connect a repository to Cyberlop for white-box scans

Connecting a repository in Cyberlop means giving a white-box target an HTTPS Git URL and a branch, so each scan can clone your latest code and read it while testing the running app. Enter both in the + New target dialog; public repositories need nothing more, and private ones need a read-only Git token for an allowed host.

What does connecting a repository do?

It lets a scan read your source as well as probe your live URL. Because Cyberlop tests with the code in view, a white-box target must carry a repository URL and a branch. At launch, the scan clones the latest code from that branch. A finding can then name the file and line, and the scan overview shows the commit it ran against.

A target without a repository is a black-box target: it tests only the URL. If you are unsure which you need, read white-box vs black-box scans first. This guide covers the white-box path only.

Connect only code you own or have permission to test. The token you give Cyberlop should be able to read the repository and nothing else.

What do you need before you connect?

You need three things: the repository address over HTTPS, the branch to scan, and, for a private repository, a Git token. Check the list below before opening the dialog, because you cannot edit a target afterwards.

Table 1. What to have ready

Is your repository public or private?

A scan clones public repositories at launch with no token. Private repositories need a Git token for a host on your allowed list. Cyberlop uses the personal token you saved first, then falls back to the organisation token.

How do you add the repository URL and branch to a target?

You add them when you create the target, in a single dialog. Work through these steps.

1. Open Targets in the sidebar and click + New target.
2. Enter a Name and the Main URL, the primary address scans run against. Add Backend / additional URLs if the app has separate API or admin hosts (optional, one per line).
3. Under Scan type, choose the White-box card. Its description says it scans your source code and needs a Git repository URL.
4. Type the Repo URL (HTTPS). The placeholder shows the shape: your code host, then your team, then the app name.
5. Leave Repo branch as main or type the branch you want.
6. Pick an Environment (Dev, Staging or Prod) and, if you like, a Team.
7. Click Create target.

Table 2. The repository fields in the New target dialog

How do you confirm the repository saved?

Open the target from the Targets list. The Target details card shows Repository and Branch, with the note "Scans clone the latest from this repository at launch." The repository URL also appears under the target name.

Targets are immutable

You cannot edit a target. To change the repository URL or branch, delete the target and create it again. Deleting a target also deletes its scan profiles, schedules, scans and findings, so export what you need first. Manage targets explains the cascade, and add a target covers the other fields.

A target with no repository

A target created without one shows "No repository configured — add a Git repository URL to run a scan." in its details. That is the black-box state. If you meant white-box, recreate the target with the repository filled in.

How do you connect a private repository with a Git token?

Save a Git token in My Account for yourself or in Settings → Git Access for the organisation, and list the code host under allowed hosts. Cyberlop uses the token only to clone, so make it read-only. Public repositories skip this section.

Should you use a personal token or an organisation token?

Use the organisation token when several people launch scans of private repositories. Use a personal token when you want your own scans to run with your own access. The page copy says Cyberlop tries the token in My Account first for scans you launch, and falls back to the organisation token if you leave yours unset.

Table 3. Personal and organisation Git tokens

How do you save a personal token?

1. Create a read-only token on your code host (see the next section for what read-only means).
2. In Cyberlop, open My Account in the sidebar.
3. In the Git access token card, paste the token into Personal Git token (private repo cloning). The status on the right changes from "Not set".
4. Click Save Git token.

Cyberlop encrypts secrets at rest and never shows them again after you save, so keep your own copy in your password manager. For a longer walk-through of the organisation side, see Git access.

How do you set the organisation token and allowed hosts?

Open Settings → Git Access, paste the token, list the code host domains, then save and verify. Once you store a token, the status pill reads "A Git token is configured." If you cannot see Settings, ask your administrator.

1. Open Settings in the sidebar and choose the Git Access tab.
2. Paste the token into Replace token. Leave it blank to keep the stored one.
3. In Allowed hosts, enter the domain of each code host that holds your repositories, separated by commas.
4. Click Save Git settings.
5. Click Verify to check the token works.
6. To remove the token later, click Clear token.

Why do allowed hosts matter?

The token is only ever sent to the hosts you list, so it cannot leak to an arbitrary repository URL. Cyberlop clones a repository on any other host without the token, as if it were public. If a private repository on a new host will not clone, the first thing to check is that its domain is in Allowed hosts.

What does a read-only token mean?

Cyberlop only clones your code, so grant read access to the repository and nothing more. The in-app warning gives two examples: on one code host, a fine-grained token with Contents: Read-only; on another, the read_repository scope or the Reporter role. The warning adds that private and public repositories are both fine and that the token should cover all branches.

This is the least privilege principle in practice. The OWASP Secrets Management Cheat Sheet asks for least privilege on secrets access and for regular rotation, so a stolen credential has a short useful life. Set a reminder to replace the token on that rhythm, and see key rotation for the habit.

Table 4. A safe token, checked

How is your code handled during a scan?

In a cloud scan, Cyberlop clones the code into an isolated workspace for each scan and wipes it from disk when the scan finishes. Nothing carries over between scans. Cyberlop describes each scan as running in its own isolated, ephemeral container, with repositories mounted read-only.

What happens to the token?

Cyberlop hands Git tokens to Git one call at a time and never writes them to disk. It encrypts stored credentials with AES-256-GCM. The activity feed records a change to the organisation token as a Git Token event with Action: set, which helps when you audit who changed access.

What is sent to the AI provider?

The Security page states that relevant code excerpts are sent to the organisation's chosen AI provider over HTTPS. If your code must not leave your network at all, run the scan on a self-hosted agent: it clones the repository from inside your network and keeps source there. Read self-hosted scan agents and private scanning.

The 2026 Verizon Data Breach Investigations Report found that 31% of breaches began with software vulnerabilities, a bigger share than stolen passwords. Reading the code while testing the app is one way to find those before someone else does.

What do you see after the first white-box scan?

The scan overview shows the commit the scan ran against and the lines of code read, and findings show a file and line range as their location. Run the scan from ▷ Scan on the target or a profile row; the run a scan guide covers the phases.

• The scan subtitle reads "Profile: … · Commit …" for white-box runs.
• Run details lists Commit with the full SHA, and Results shows Lines of code.
• The Findings tab shows a source file and line range, plus an Endpoint: line.

The repository also powers one profile feature. After you save a scan profile, ✦ Auto Generate from Repo in the Reporting section can fill the application context from it; see application context. If you trigger scans from a pipeline, the CI call can pass a commitSha; see CI/CD integration.

What if the repository will not connect?

Most problems come from the URL shape, the host list or the token. The app documentation does not list a specific clone error message, so use this checklist and ask your administrator if the scan still fails.

Table 5. Common mistakes

Mistakes that cost time

Do not put the token inside the repository URL. Do not grant write access "just in case". And do not scan a repository you do not own or have permission to test. Keep hardcoded secrets out of the code the scan reads, and manage them with secrets management.

What is the next step?

Next step: create a scan profile for your new target, then run your first scan. If you also need a black-box target, see verify target ownership. New to the terms? Start with key terms or getting started.