Home / Help centre / Security & privacy
Security & privacy
Could my Git token be sent to a repository host I don't control?
No. Cyberlop sends your Git token only to the hosts you list under Allowed hosts. Cyberlop clones a repository on any other host without the token, as if it were public. It stores the token encrypted, hands it to git for each clone only, and never writes it to disk.
The short version
Your Git token has one job: cloning private repositories over HTTPS. Cyberlop ties it to a list of hosts you choose, so a repository URL on a host outside that list never receives it.
How it works in Cyberlop
Open Settings → Git Access. The Allowed hosts field holds the domains your code lives on. The page explains the rule in one line: the token is only ever sent to those hosts, so it cannot leak to an arbitrary repo URL.
- On an allowed host, Cyberlop clones with the token.
- On any other host, Cyberlop clones without it and treats the repository as public, so a private repo there simply fails to clone.
- Cyberlop stores the token encrypted at rest and never shows it again once you save it.
- For each clone, the token goes to git for that one call and never touches the disk.
- A cloud scan wipes the cloned code when the scan reaches a terminal state, which means completed, failed or cancelled.
Scope the token as tightly as you can. Cyberlop only reads your code, so create a read-only token that covers the repositories you scan and nothing more. A narrow token limits the damage if it ever leaks from somewhere else, such as an old laptop or a shared note.
What to do next
- Open Settings → Git Access and fill in Allowed hosts with only the domains you use.
- Click Save Git settings, then Verify.
- Use Clear token if you want to remove the token altogether.
You can also set a personal token under My Account. Read personal vs organisation Git token to see which one a scan uses. For wider detail on how Cyberlop protects credentials, see the security page. A short definition of the idea lives in allowlist.
Related questions
- How do I add an organization Git token for private repositories?
- How do I limit which hosts the Git token is sent to?
- Why is my repository being cloned without my Git token?
- What permissions should my Git token have?
- What's the difference between my personal Git token and the organization's Git token?
Git access in Cyberlop: set a read-only token and allowed hosts
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.