Why doesn't my CI-triggered scan show a commit?

Why this happens

The scan detail page lists Commit under Run details for white-box scans only. For black-box scans the field is absent, since Cyberlop tests the live URL without any code. A CI request can also pass a commit hash. The API marks commitSha as optional. That means a request you wrote by hand can leave it out, and the scan then has nothing to show in that field.

How to fix it

1. Open the target. A black-box target says "No repository configured", so its scans never show a commit.
2. Go to Recent Scans and open the run. The subtitle shows "Commit" with a short hash for white-box scans.
3. See whether the run says Manual or came from CI. Manual runs started with the Scan button have no pipeline commit to send.
4. In Integrations, copy the snippet again. Its request body holds profileId and commitSha.
5. Trigger the pipeline once more and open the new scan.

The generated snippets fill it for you. The first tab sends the commit of the push, and the second uses the CI commit variable. If you wrote your own job, copy that line across from the snippet. Short, plain steps like these save a lot of guessing later.

Still not working?

A white-box scan still clones the latest code from the target’s repository when it launches. See how Cyberlop picks the code. For related questions read where the commit appears and why a scan has no commit. If a white-box CI scan still shows no commit, send the scan ID through the contact page.

Related questions

• How do I see which commit a white-box scan tested?
• Why is there no commit shown on my scan?
• Can I scan a specific commit instead of the latest one?
• How do I trigger a Cyberlop scan from my CI pipeline?
• Can I trigger a CI scan by profile name instead of profile ID?

Full tutorial

How to add security scanning to your CI/CD pipeline

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre