Home / Help centre / Security & privacy
Security & privacy
Can Cyberlop change anything in my repository?
No. Cyberlop clones your repository just to read it, and the scan container mounts the code read-only. Settings asks you for a read-only token on the Git Access tab, so the credential you provide has no power to write to your repository either.
The short version
Cyberlop reads your code and never writes to it. It clones the repository, the scan container mounts the copy read-only, and the page where you add a token asks for read-only access.
| Where | What it says |
|---|---|
| Settings, Git Access | Use a read-only token; Cyberlop only clones (reads) your code |
| Security page | Repositories mount read-only in the scan container |
| Fine-grained token at your code host | Contents: Read-only |
| Token with named scopes | read_repository or Reporter level |
How it works in Cyberlop
The Git Access tab carries an amber warning: "Use a read-only token. Cyberlop only clones (reads) your code, so grant read-only repository access (all branches; private & public both fine) — nothing more."
That advice is also a safety net. If you grant only read access, the credential has no way to push a commit or alter a branch, whatever happens elsewhere. You set the limit at your code host, and the limit holds no matter what any tool tries.
Cyberlop sends the token only to the allowed hosts you list, and passes it to git for each call without writing it to disk. The scan reads the clone. Findings stay in the app, not in your repository.
Fixing the code stays with your team. A finding names the file and line, and your developers change the code through their normal review.
What to do next
- Create a read-only token with the permissions to grant.
- Add it using how to add an organisation Git token.
- Press Verify on the Git Access tab to test it.
Questions about access? Reach us at /contact.
Related questions
- What permissions should my Git token have?
- How do I add an organization Git token for private repositories?
- How do I limit which hosts the Git token is sent to?
- Could my Git token be sent to a repository host I don't control?
- Is each scan isolated from other scans?
Git access in Cyberlop: set a read-only token and allowed hosts
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.