Why doesn't my black-box scan report code-level findings with file and line?

Why this happens

The scan type decides what Cyberlop can see. White-box reads the source code and tests the running app. Black-box tests the live URL only. With no code to read, the best location it can give is the endpoint that behaved wrongly.

How to fix it

1. Open the target. Black-box targets show "No repository configured".
2. On the finding, Location shows an HTTP method and path for black-box findings.
3. On Targets, click + New target and choose the White-box card.
4. Add the Repo URL (HTTPS) and the Repo branch.
5. Create a profile on the new target and scan. Findings now carry a source location.

For white-box findings, the Location column shows the source file and line range, with an extra Endpoint line, such as a DELETE route. The summary also lists the commit that was scanned.

Still not working?

You can keep both targets. The black-box one shows what an outsider can reach. The white-box one adds the code view. Black-box targets also need ownership verification before they can run, by DNS TXT record or staff approval. Repositories must use HTTPS, since SSH is not supported. Read white-box and black-box compared, how a code finding shows its endpoint and how to connect a repo. Questions? Use the contact page.

Related questions

• What's the difference between a white-box and a black-box target?
• How do I create a black-box target with no source code?
• How do I find which endpoint a white-box code finding affects?
• How do I connect a Git repository to a target?
• Why does my black-box target say "No repository configured"?

Full tutorial

White-box vs black-box scans: how to choose a scan type in Cyberlop

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre