Which secrets do I need to add to my repository for CI scans?

Steps

1. Copy the base URL of your Cyberlop app, with no path after the host name.
2. Get your personal API token. An admin issues it from Administration → Users. See how to get a personal API token.
3. Open the secrets page of your repository in your code host.
4. Name the first secret CYBERLOP_URL and paste the URL as its value.
5. Give the second secret the name CYBERLOP_API_TOKEN and paste your token as its value, then save both.

Good to know

The footer on the Integrations page repeats this advice: add these two secrets to your repository. Every step of the generated job reads them from the repository secrets, so the names must match exactly, including the capital letters.

Keep the token out of the YAML file. Anything you paste into a committed file is visible to everyone with access to the repository, while a secret stays hidden in the build log.

Remember that the scan runs with the token owner's permissions and group scope, which means a token from someone who cannot run the profile makes the trigger call fail. Read whose permissions a CI scan runs with for the detail. If the job still cannot start a scan, work through why a CI job cannot trigger a scan.

Related questions

• Where do I store the Cyberlop URL and API token in my CI's settings?
• How do I get a personal API token?
• Whose permissions does a CI-triggered scan run with?
• My CI job can't trigger a scan. What should I check?
• How do I trigger a Cyberlop scan from my CI pipeline?

Full tutorial

How to add security scanning to your CI/CD pipeline

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre