Home / Help centre / Security & privacy
Security & privacy
Does my code leave my network when I use a scan agent?
No. A self-hosted scan agent clones your repository and reaches the target from inside your network, and it connects out over HTTPS only. The Security page calls this zero source egress. Results, cost and the live log stream back to the app.
The short version
Your source stays home. The agent is a container you run on your own network. It clones the repository there, tests the app there, and sends results out over a single outbound connection.
| Question | Answer |
|---|---|
| Where does the repository clone? | Inside your network, on the agent |
| Which direction do connections go? | Outbound HTTPS only, no inbound ports |
| What reaches Cyberlop? | Live log, cost and findings |
| What does the Security page call this? | Zero source egress |
How it works in Cyberlop
Your agent asks Cyberlop for queued jobs on an outbound long-poll. When a job arrives, it clones the repo, reaches the target from inside your network and starts a local engine. Then it runs the same five-phase pipeline a cloud scan runs. You need only outbound 443 to app.cyberlop.com, with no inbound ports and no firewall changes.
Live log, cost and findings stream back, so the scan looks the same in the app. The repository itself does not travel.
Be exact about one thing. According to the Security page, the AI provider step sends relevant code excerpts to the provider your organisation chose. The captured pages do not spell out how that step works on an agent, so ask us before you promise anything to an auditor.
What to do next
- Create an agent with how to add a scan agent.
- Point a profile at it with how to run a profile on an agent.
- Read the network needs in agent network requirements.
For the AI provider question, contact us at /contact. You can also read about private scanning.
Related questions
- What is a self-hosted scan agent, and when do I need one?
- What network access does a scan agent need?
- What happens to my source code after a cloud scan?
- Is my code sent to an AI provider?
- I removed a scan agent. Where do my profiles' scans run now?
Cyberlop self-hosted scan agents: scan private apps from inside your network
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.