How can we help?

How do I go from a fresh sign-in to my first finished report?Getting started What do I need to set up before I can run a scan?Getting started Where do I find the built-in documentation and step-by-step walkthrough?Getting started How do I switch between light and dark mode?Getting started How do I sign out of Cyberlop?Getting started How can I see which role I'm signed in with?Getting started How do I tell which workspace I'm working in?Getting started What is each item in the sidebar menu for?Getting started Why don't I see Administration in my sidebar?Getting started What does the Dashboard show?Getting started What do the Targets, Total scans, Running scans and Fixed issues cards count?Getting started What does Fix rate mean in the Remediation card?Getting started How do I open a scan or target from the Dashboard?Getting started Why can't I start a scan from the Dashboard?Getting started What is Cyberlop and what does it test?Getting started What are the five phases of a Cyberlop scan?Getting started What's the difference between a target, a scan profile and a scan?Getting started Where do I find the Privacy and Security pages?Getting started Why does the Cost column on the Dashboard show a dash for some scans?Getting started How do I see how many findings are still open across all my targets?Getting started Does Cyberlop use a real browser when it tests my app?Getting started How do I add a new target?Targets & repositories How do I add backend or API URLs to a target?Targets & repositories How do I mark a target as Dev, Staging or Prod?Targets & repositories How do I assign a target to a team?Targets & repositories How do I scan a branch other than main?Targets & repositories How do I connect a Git repository to a target?Targets & repositories How do I create a black-box target with no source code?Targets & repositories How do I verify that I own a black-box target?Targets & repositories Where can I see whether a target's ownership has been verified?Targets & repositories How do I change a target's URL or repository after creating it?Targets & repositories How do I delete a target?Targets & repositories How do I search my targets by name, URL or tag?Targets & repositories How do I see a target's repository, branch and environment?Targets & repositories How do I start a scan straight from the Targets list?Targets & repositories How do I see all the scan profiles for one target?Targets & repositories How do I create a profile that's already set to a specific target?Targets & repositories How do I scan a private repository?Targets & repositories What do the coloured dots in the Results column of the Targets list mean?Targets & repositories Why does a target show a dash in the Results column?Targets & repositories What's the difference between a white-box and a black-box target?Targets & repositories What does it mean that targets are immutable?Targets & repositories Does Cyberlop scan the latest code from my repository each time?Targets & repositories What are the ways to prove I own a black-box target?Targets & repositories Do white-box targets need ownership verification?Targets & repositories Why isn't my git@ SSH repository URL accepted?Troubleshooting What does "No repository configured — add a Git repository URL to run a scan." mean?Troubleshooting Why does my black-box target say "No repository configured"?Targets & repositories My private repository won't clone. What do I need?Troubleshooting Why is my repository being cloned without my Git token?Targets & repositories Why are the repository fields greyed out in the New target dialog?Targets & repositories Why can't I run a black-box scan on my new target?Troubleshooting Why is there no edit button for my target?Targets & repositories Why does Plan & usage say targets added this month are "also limited"?Targets & repositories I created a target with the wrong environment. How do I fix it?Targets & repositories Why can't I find the Ownership verification card on my target?Targets & repositories The New target dialog says a repo URL is required, but my app has no repository. What do I do?Targets & repositories How do I create a scan profile?Scan profiles How do I add tags to a scan profile?Scan profiles How do I choose which vulnerability classes a profile tests?Scan profiles How do I make a profile test all vulnerability classes?Scan profiles How do I turn off the exploitation phase?Scan profiles How do I make a profile run on a self-hosted scan agent instead of the cloud?Scan profiles How do I add a focus rule so a scan concentrates on certain paths?Scan profiles How do I exclude a URL path or subdomain from a scan?Scan profiles How do I stop a scan from testing a certain HTTP method?Scan profiles How do I focus a white-box scan on one part of my codebase?Scan profiles How do I keep the scanner away from a particular parameter or header?Scan profiles How do I delete a focus or avoid rule?Scan profiles How do I set a minimum severity for a profile's report?Scan profiles How do I leave low-confidence findings out of the report?Scan profiles How do I steer how the final report is written?Scan profiles How do I add rules of engagement, such as no destructive payloads in production?Scan profiles How do I fill in the Application context for a profile?Scan profiles How do I auto-generate the Application context from my repository?Scan profiles How do I preview the YAML config a profile generates?Scan profiles How do I edit an existing scan profile?Scan profiles How do I delete a scan profile?Scan profiles How do I find a profile by name, target or tag?Scan profiles How do I filter the profiles list by tag?Scan profiles How do I move between Scope, Authentication and Reporting in a profile?Scan profiles Can I have more than one scan profile for the same target?Scan profiles What is a scan profile?Scan profiles What does the exploitation phase do?Scan profiles Which vulnerability classes can Cyberlop test for?Scan profiles What does the Business-logic class cover?Scan profiles What's the difference between the Auth and Authz classes?Scan profiles What does the Config class look for?Scan profiles What kinds of injection does the Injection class cover?Scan profiles Does Cyberlop check for exposed secrets and vulnerable dependencies?Scan profiles What's the difference between focus rules and avoid rules?Scan profiles Which rule types can I use in focus and avoid rules?Scan profiles Why does the profiles list show "All" under Vuln classes?Scan profiles What does "name: String must contain at least 1 character(s)" mean?Troubleshooting Why is "Auto Generate from Repo" greyed out?Troubleshooting Why can't I change the target on my scan profile?Scan profiles Why won't a profile set to my scan agent start a scan?Scan profiles Why doesn't my scan agent appear in the Scan location list?Scan profiles How do I add a login role to a scan profile?Authentication & logins How do I set a role's privilege level?Authentication & logins How do I combine form login and a header token for one role?Authentication & logins How do I set up form login for the scanner?Authentication & logins How do I choose between the FORM, SSO, API and BASIC login types?Authentication & logins How do I tell the scanner how to recognise a successful login?Authentication & logins How do I write the login flow steps?Authentication & logins How do I handle a login that asks for email and password on separate screens?Authentication & logins How do I let the scanner get past a TOTP two-factor prompt on my app?Authentication & logins How do I authenticate the scanner with an API key header?Authentication & logins How do I send a Bearer token in the Authorization header?Authentication & logins How do I remove a header from a role?Authentication & logins How do I set up OAuth 2.0 client credentials for a role?Authentication & logins How do I request a specific OAuth scope for the scanner's token?Authentication & logins How do I change the header name or prefix the OAuth token is sent with?Authentication & logins How do I test the OAuth token exchange before running a scan?Authentication & logins How do I give the scanner AI guidance on how to use a credential?Authentication & logins How do I set up two user roles so the scanner can test access between accounts?Authentication & logins How do I change a stored password on a role?Authentication & logins How do I edit a role without re-entering its password?Authentication & logins How do I clear stored form credentials from a role?Authentication & logins How do I remove a login role from a profile?Authentication & logins How do I run a scan without any login?Authentication & logins What is an authentication role?Authentication & logins What privilege levels can a role have?Authentication & logins Which login methods does Cyberlop support for scanning behind a login?Authentication & logins How does Cyberlop use OAuth 2.0 client credentials during a scan?Authentication & logins What kind of instructions belong in a role's AI guidance?Authentication & logins What does "No auth roles. Add a role to scan behind login, or leave empty for unauthenticated scanning." mean?Authentication & logins Why is the password field empty when I edit my profile?Authentication & logins What does "Form credentials stored — leave fields blank to keep it." mean?Authentication & logins Why is the Complete authentication button greyed out?Authentication & logins The scanner isn't getting past my login page. What should I check?Troubleshooting My API rejects the OAuth token part-way through a scan. How do I tell the scanner to get a fresh one?Authentication & logins My scan found nothing behind the login. Why?Troubleshooting My app doesn't land on a fixed URL after login. How do I set the success condition?Authentication & logins Complete authentication didn't return a token. What should I check?Authentication & logins How do I start a scan?Running scans How do I re-run a previous scan?Running scans How do I start a scan from a target's page?Running scans How do I watch a scan while it's running?Running scans How do I get the latest status on a scan's page?Running scans How do I cancel a running scan?Running scans How do I delete a scan run?Running scans How do I find a scan by target or profile name?Running scans How do I see who started a scan?Running scans How do I see which commit a white-box scan tested?Running scans Where do I see how much a scan cost and how many tokens it used?Running scans Where do I see how many lines of code a scan analysed?Running scans How do I see when a scan started and finished?Running scans How do I open the profile a scan used?Running scans How do I see the severity breakdown for one scan?Running scans How long does a scan take?Running scans What do Completed, Failed and Cancelled mean on a scan?Running scans What does the trigger badge, such as Manual, mean on a scan?Running scans What can I see on a scan while it's still running?Running scans What happens when I start a scan from a profile set to a scan agent?Running scans What happens in the recon phase?Running scans Can a long analysis get cut off part-way?Running scans What does "Scan failed — The scan could not be completed" mean, and what should I do?Troubleshooting Why does my failed scan still show findings?Troubleshooting Why is my scan taking much longer than usual?Troubleshooting Why can't I see the raw workflow log for my scan?Troubleshooting Why won't a new scan start while others are already running?Troubleshooting Why does Lines of code show a dash on my scan?Running scans Why does a scan show a support staff name under Run by?Running scans Why is there no commit shown on my scan?Running scans How do I see the full details of a finding?Results & findings How do I see the HTTP request and response that proved a finding?Results & findings How do I reproduce a finding myself?Results & findings Where do I find the screenshot captured as evidence?Results & findings How do I see the exact payload used to prove a finding?Results & findings How do I change a finding's status?Results & findings How do I mark a finding as a false positive?Results & findings How do I mark a finding as accepted risk?Results & findings How do I mark a finding as fixed?Results & findings How do I reopen a finding I closed?Results & findings How do I assign a finding to a teammate?Results & findings How do I add notes to a finding?Results & findings How do I show only critical findings?Results & findings How do I filter findings by confidence?Results & findings How do I see only one vulnerability class, like Injection?Results & findings How do I see findings for just one target?Results & findings How do I search findings by title or file location?Results & findings How do I hide fixed and false-positive findings from the Issues list?Results & findings How do I show only New and Regression findings?Results & findings How do I see the findings from one specific scan?Results & findings How do I see which endpoints a scan discovered?Results & findings How do I filter the sitemap by URL or method?Results & findings How do I compare a scan with the previous one?Results & findings How do I find findings that came back after being fixed?Results & findings How do I confirm my fixes worked?Results & findings How do I find which endpoint a white-box code finding affects?Results & findings How do I see when a finding was first reported?Results & findings How do I see who changed a finding's status?Results & findings Can I link a finding to a ticket in my issue tracker?Results & findings How does the Hiding / Showing only switch on the Issues page work?Results & findings What severity levels does Cyberlop use?Results & findings What's the difference between Confirmed, Likely and Unconfirmed?Results & findings What's the difference between a finding's Status and its Triage state?Results & findings What do New, Regression, Fixed, False Positive and Accepted Risk mean?Results & findings Will a finding I marked as a false positive come back on the next scan?Results & findings What does a finding ID like INJ-VULN-02 mean?Results & findings How does Cyberlop avoid reporting the same issue twice?Results & findings If two agents rate an issue differently, which severity wins?Results & findings What's the difference between the Issues page and a scan's Findings tab?Results & findings What do the note and role chip on each sitemap endpoint mean?Results & findings Which scan does the Diff tab compare against?Results & findings Why didn't my notes on a finding save?Troubleshooting Why does the Diff tab say "No previous scan to compare against."?Troubleshooting Why was a finding marked Fixed when I didn't change it?Results & findings Why did a finding I fixed come back as a Regression?Results & findings Why are some findings missing from my Issues list?Troubleshooting Why do some confidence values look faded in the Issues list?Results & findings Why doesn't my finding have a screenshot?Results & findings Why can't I find a teammate in the Assignee list?Results & findings What does "No auth header was attached to the proving request." mean?Results & findings Why aren't any of my findings marked Confirmed?Results & findings How do I download a PDF report for a scan?Reports & exports How do I get a report that shows only open issues?Reports & exports How do I include fixed and accepted-risk issues in a report?Reports & exports How do I produce a report of only the issues that were fixed?Reports & exports How do I download the latest report for a target?Reports & exports How do I download a report from the Recent Scans list?Reports & exports How do I export findings to CSV?Reports & exports How do I export findings as JSON?Reports & exports How do I export my list of targets?Reports & exports How do I export a scan's sitemap?Reports & exports How do I put my company logo on reports?Reports & exports How do I download a scan report through the API?Reports & exports What's the difference between the three report download options?Reports & exports What's in the PDF report?Reports & exports How do minimum severity and minimum confidence affect my report?Reports & exports Why is there no Report button on my scan?Reports & exports Why is the report icon missing next to my target?Reports & exports Why won't my report logo save?Troubleshooting Why does my report list fewer findings than the scan's Findings tab?Troubleshooting Why can't I download reports?Reports & exports How do I schedule a recurring scan?Scheduling & automation How do I schedule a single scan for a later date?Scheduling & automation How do I choose the time a scheduled scan runs?Scheduling & automation How do I turn a schedule off without deleting it?Scheduling & automation How do I delete a schedule?Scheduling & automation How do I change the timezone scheduled scans use?Scheduling & automation Which scheduling frequencies are available?Scheduling & automation How is a recurring schedule's timing worked out?Scheduling & automation Do scheduled scans shift when daylight saving time changes?Scheduling & automation How can I tell whether a scan was started by a schedule?Scheduling & automation Can I change a schedule after creating it?Scheduling & automation What's the difference between scheduled scans and CI-triggered scans?Scheduling & automation I deleted a profile and its schedules disappeared. Why?Scheduling & automation My scheduled scan ran at the wrong hour. Why?Scheduling & automation Why didn't my scheduled scan run?Scheduling & automation Why can't I create a schedule?Scheduling & automation How do I trigger a Cyberlop scan from my CI pipeline?Integrations & API How do I copy the ready-made CI workflow for my code host?Integrations & API How do I choose which profile my CI job scans?Integrations & API Which secrets do I need to add to my repository for CI scans?Integrations & API Where do I store the Cyberlop URL and API token in my CI's settings?Integrations & API How do I get a personal API token?Integrations & API How do I authenticate requests to the Cyberlop API?Integrations & API How do I launch a scan through the API?Integrations & API How do I check a CI-triggered scan's result through the API?Integrations & API How do I download the API spec?Integrations & API How do I find the endpoint I need and the permission it requires?Integrations & API How do I pull the findings for one scan through the API?Integrations & API How do I connect my cloud key vault?Integrations & API How do I check that my key vault connection works?Integrations & API How do I manage scan agents through the API?Integrations & API How do I list my targets through the API?Integrations & API How do I get the Dashboard numbers through the API?Integrations & API How do I get the new, fixed and regressed findings for a scan through the API?Integrations & API Can I search across targets, profiles, schedules, issues and scans at once?Integrations & API Can I trigger a CI scan by profile name instead of profile ID?Integrations & API Can I scan a specific commit instead of the latest one?Integrations & API Whose permissions does a CI-triggered scan run with?Integrations & API When does the generated CI workflow run?Integrations & API What can I do with the Cyberlop API?Integrations & API What is the cloud key vault integration used for?Integrations & API Can I use Cyberlop with a CI system that has no ready-made snippet?Integrations & API Why did my CI job pass even though Cyberlop found critical issues?Troubleshooting My CI job can't trigger a scan. What should I check?Integrations & API Why does my API call return a permission error?Troubleshooting My CI job stopped waiting before the scan finished. Why?Integrations & API I lost my API token. Can I see it again?Integrations & API How do I add a new user to my workspace?Team & access How do I create a custom role with specific permissions?Team & access How do I create a team?Team & access How do I create a group of scan profiles?Team & access How do I add all profiles with a certain tag to a group?Team & access How do I pick individual profiles for a group?Team & access How do I create a tag in the tag registry?Team & access How do I delete a tag?Team & access How do I update or delete a group?Team & access How do I see what's been happening in my workspace?Team & access How do I search the activity feed for a person or action?Team & access How do I find out who cancelled or deleted a scan?Team & access How do I revoke a user's API tokens?Team & access How do I remove a user from my workspace?Team & access How do I see each user's role and team grants?Team & access Which roles come built in?Team & access How are permissions named?Team & access Which permissions can I give a custom role?Team & access What are groups used for?Team & access What's the difference between groups and tags?Team & access Who can see which entries in the activity feed?Team & access Which actions show up in the activity feed?Team & access What does the "system" chip mean in the activity feed?Team & access What is a Support Session entry in the activity feed?Team & access Can I give someone access to only some of our targets?Team & access Why can't I edit or delete the SuperAdmin role?Team & access Why can't I delete the base admin account?Team & access Why can't I delete a target?Team & access Why can't I see other people's actions in the activity feed?Team & access Why can't I change a finding's status?Team & access Why do I get a permission error when I try to start a scan?Team & access Why can't I export findings?Team & access How do I change my organization's name?Workspace settings How do I change how long data is kept?Workspace settings Where can I see my plan limits and usage?Workspace settings How do I check how many scans I've used this month?Workspace settings How do I check how much of the included Cyberlop AI allowance I've used?Workspace settings How do I see how much model usage went on our own AI key this month?Workspace settings How do I change my plan?Workspace settings Where can I see my billing history and invoices?Workspace settings Who do I contact about billing?Workspace settings How do I use my organization's own AI provider key?Workspace settings How do I check that my AI provider credential works?Workspace settings How do I remove the organization's AI credential?Workspace settings How do I pick which AI model each tier uses?Workspace settings How do I use a model that isn't in the dropdown?Workspace settings How do I go back to the default models?Workspace settings How do I add an organization Git token for private repositories?Workspace settings How do I limit which hosts the Git token is sent to?Workspace settings How do I check that my Git token works?Workspace settings How do I remove the organization's Git token?Workspace settings How do I add my own personal Git token?Workspace settings How do I add my own AI credential for scans I start?Workspace settings How do I turn email notifications on or off?Workspace settings How do I send scan notifications to my chat tool?Workspace settings How do I send a test message to my chat webhook?Workspace settings How do I add a self-hosted scan agent?Workspace settings Where and how do I run the scan agent container?Workspace settings How do I remove a scan agent?Workspace settings How do I see whether my scan agent is online?Workspace settings How do I see when my scan agent last checked in?Workspace settings How do I set up single sign-on with my identity provider?Workspace settings Where do I find the redirect URI to give my identity provider?Workspace settings How do I let new people get accounts automatically through SSO?Workspace settings How do I make two-factor authentication mandatory for my workspace?Workspace settings What's the difference between my personal Git token and the organization's Git token?Workspace settings What's the difference between my personal AI credential and the organization's?Workspace settings What are the Deep analysis, Recon & exploitation and Lightweight tasks tiers?Workspace settings Should I use an API key or a subscription OAuth token for my AI provider?Workspace settings How is AI usage measured, and when does it reset?Workspace settings What is Cyberlop AI?Workspace settings What does a chat notification include?Workspace settings Which email notifications can I get?Workspace settings What is a self-hosted scan agent, and when do I need one?Workspace settings What network access does a scan agent need?Workspace settings What do pending, online and offline mean for a scan agent?Workspace settings Does adding a scan agent let me run more scans at once?Workspace settings What does "Require an admin-bound SSO subject" do?Workspace settings Which identity providers work with Cyberlop single sign-on?Workspace settings What happens to people without MFA when I make it mandatory?Workspace settings Where do I see which features my plan includes?Workspace settings What permissions should my Git token have?Workspace settings If both I and my organization have a token set, which one does a scan use?Workspace settings Why can't I tick "Enable single sign-on"?Troubleshooting Why didn't a new SSO user get an account automatically?Workspace settings Why can't a new SSO user sign in for the first time?Troubleshooting Why is "Send test message" greyed out?Workspace settings My webhook URL isn't accepted. What format does it need?Workspace settings What does "No webhook — notifications are off." mean?Workspace settings Why is my scan agent stuck on pending?Troubleshooting Why does my scan agent show as offline?Troubleshooting I lost the agent enrollment token. Can I get it again?Workspace settings Why can't I see my saved token or key any more?Troubleshooting Why did my scan cover less of my codebase than expected?Troubleshooting I picked a premium model, but the results aren't any better. Why?Troubleshooting Why are my scans paused until next month?Troubleshooting Why am I not getting scan-finished emails?Troubleshooting Why don't I get critical or high alerts for my teammates' scans?Workspace settings Why isn't anyone being asked to set up MFA?Troubleshooting I removed a scan agent. Where do my profiles' scans run now?Troubleshooting Why did my scan use the organization's Git token instead of mine?Workspace settings How does Cyberlop store my credentials and tokens?Security & privacy How are user passwords stored?Security & privacy How are sign-in sessions secured?Security & privacy Is my workspace's data kept separate from other organizations?Security & privacy What happens to my source code after a cloud scan?Security & privacy Does my code leave my network when I use a scan agent?Security & privacy Is each scan isolated from other scans?Security & privacy Can Cyberlop change anything in my repository?Security & privacy Is my code sent to an AI provider?Security & privacy Can Cyberlop staff see my source code?Security & privacy Does Cyberlop redact personal data I type into a profile?Security & privacy What kinds of personal data are redacted?Security & privacy Do Cyberlop's application logs contain my tokens or cookies?Security & privacy Can I delete scans, targets and data whenever I want?Security & privacy Is traffic to and from Cyberlop encrypted?Security & privacy How do I report a security issue in Cyberlop?Security & privacy Could my Git token be sent to a repository host I don't control?Security & privacy Can I see what each agent did during a scan and how it reached a finding?Security & privacy How do I keep testing safe on a production app?Security & privacy Why isn't my new password accepted?Security & privacy I'm locked out after several failed sign-in attempts. What happened?Troubleshooting Why was I suddenly signed out of all my sessions?Security & privacy Why aren't SSO users asked for Cyberlop's own MFA?Security & privacy I closed my browser while a scan was running. Did the scan stop?Running scans I deleted a scan, but its findings are still on the Issues page. Why?Running scans Why doesn't the YAML preview show my passwords or tokens?Scan profiles I deleted a target and its profiles, schedules, scans and findings disappeared too. Why?Troubleshooting IP addresses and URLs in my rules of engagement weren't redacted. Is that expected?Security & privacy My finding shows a file path and line number instead of a URL. Is something wrong?Results & findings Why do I see several separate findings in the same file?Results & findings My scan agent is online, but scans still run in the Cyberlop cloud. Why?Troubleshooting My chat notification doesn't list the findings. Is something broken?Workspace settings I typed a tag but it wasn't added to my profile. What did I miss?Scan profiles Why can't I save a new profile without choosing a target?Scan profiles I clicked Scan on Recent Scans and a new scan started instead of opening the old one. Why?Running scans Why can't I delete a role?Team & access The Diff tab says "+46 more". Where are the rest of the findings?Results & findings My API token suddenly stopped working. Why?Troubleshooting My CI job can't scan a profile that a teammate can see. Why?Integrations & API Why can't I find the allowed-domains field in the SSO settings?Workspace settings Why did an amber warning appear when I chose the OAuth token option?Workspace settings The target picker in my new profile is empty. Why?Scan profiles Why can't I pick a target when creating a schedule?Scheduling & automation The token field stays blank after saving. How can I tell whether my Git token saved?Troubleshooting Why did I get two emails about the same scan?Workspace settings Why can't I see some targets that my colleague can see?Team & access Why can't Auto Generate from Repo fill the context for my black-box target?Scan profiles My key vault connection won't verify. What should I check?Integrations & API Why doesn't my CI-triggered scan show a commit?Integrations & API Why did my scan test the main branch instead of my feature branch?Targets & repositories I can't put several URLs in the Main URL field. Where do the others go?Targets & repositories I fixed the code, but the finding is still open. Why?Troubleshooting Why didn't a teammate's scan use my personal AI credential?Workspace settings My app is only reachable inside our network, so cloud scans can't reach it. What do I do?Troubleshooting Searching for a finding ID on the Issues page finds nothing. Why?Results & findings Why can't I search Recent Scans by the person who ran them?Running scans Why is the exploitation phase turned on in my new profile when I didn't tick it?Scan profiles My role only uses an API token, but Form login is ticked. Should I untick it?Authentication & logins Why didn't the CI workflow run when I pushed to my feature branch?Integrations & API Why doesn't my report include the issues we've fixed?Reports & exports Why does my findings export include only some of my findings?Reports & exports My scan didn't test our separate API host. Why?Targets & repositories Why doesn't my black-box scan report code-level findings with file and line?Targets & repositories My white-box target asks for a Main URL even though you have the code. Why?Targets & repositories What does "Correctly gated — HTTP 401" mean in my sitemap?Results & findings I added a scan agent but still can't run more scans at once. Why?Workspace settings