Home / Help centre / Scan profiles
Scan profiles
Does Cyberlop check for exposed secrets and vulnerable dependencies?
Yes, Dependency and Secrets are two of the ten vulnerability classes on the profile form. Tick them, or tick none to scan all ten. The in-app documentation does not describe the exact checks behind these two, so for details please ask us.
The short version
Yes, both are on the list. In the Scope section of a scan profile, the ten checkboxes include Dependency and Secrets. You can tick one, both, or leave every box empty to scan all ten classes.
How it works in Cyberlop
The documentation describes eight specialist agents in detail: injection, xss, auth, authz, ssrf, crypto, config and business-logic. Dependency and Secrets appear as checkboxes on the form and in the product map, but the pages we can see do not explain what each one inspects or how it reports. We would rather say so than guess.
What the documentation does say about every finding applies here too. Each one carries a severity, a confidence, a class and a location. For a white-box scan the location is a file and line. Findings can be triaged, reported and compared between scans like any other.
| Question | Answer |
|---|---|
| Are the classes on the form? | Yes, as Dependency and Secrets |
| Can I leave them out? | Yes, by ticking only the classes you want |
| Are the exact checks listed in the app? | No, not in the pages we can see |
Because Cyberlop reads your source code, white-box scans give these classes the most to work with. A black-box target has no repository, so code-level findings are not possible there. See why black-box scans show no code findings.
What to do next
Open a profile, go to Scope and tick the classes you want. If you need to know exactly which ecosystems, file types or key formats are covered, contact us and we will answer from the product itself.
The glossary pages on hardcoded secrets and dependency vulnerabilities explain what these problems are. For the full class list, read which vulnerability classes Cyberlop tests.
Related questions
- Which vulnerability classes can Cyberlop test for?
- How do I choose which vulnerability classes a profile tests?
- How do I make a profile test all vulnerability classes?
- Why doesn't my black-box scan report code-level findings with file and line?
- What's the difference between a white-box and a black-box target?
Choose vulnerability classes in a Cyberlop scan profile
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.